Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
8cd88b35cf93a715ac1a503ee9af5f18_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8cd88b35cf93a715ac1a503ee9af5f18_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8cd88b35cf93a715ac1a503ee9af5f18_JaffaCakes118.html
-
Size
5KB
-
MD5
8cd88b35cf93a715ac1a503ee9af5f18
-
SHA1
8cc66bd9dbd0787e00c76429e6b49d8cdff77989
-
SHA256
906ab7f47ff54c2a8387d1d8483c98c696c534c37dc06aaf478c53e85f2eb7a3
-
SHA512
c5688be1c1de37a84846476aca0a3a90f5637bf751591119c58def50c9763943678b58652a355c976fa7cff05dfa8fdb71a55d899ae5b27d3a1d0edce483f9dc
-
SSDEEP
48:ImJek0/KxXdSD0wH/zzOc1ffnm2HAieCWDMamhAcddVOskXCb2tVAAzwKGLVcoAW:3kKhdSDEwPHACW+AWab/3kKGmwoBm
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000aab96f6c3e477f5011d4e057abe4687f11b3e61facd29e932e0207c786472164000000000e8000000002000020000000e92c94d67a7ce1305fe9c30669fbeb20cb7bbd718f1c2183ac3ba6623bf22cc120000000c1a01a492db186dd34dcfb6c35cdc4c582469845835a49fa1529abe057742f1a4000000034f4d7644c366077f9dcbdfca53adf837ef8dca4a60591ba714b06e4541bd7bcc163ffd59fdc9a7efc865708fcd1ac585b264f0bb22317a8f1e567b4a170dbd9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000001783f17133feea9fdd10407fb4e3e7a2dd275a46d08efd64bbba4bf2750ad3b000000000e80000000020000200000002f08ceb1e7bb08c1cfb2b61505d893d4e172abe1f3f1ab04fcbe6124df5796f29000000016e74672a2865b0185da6508d6a57f9b9f6a4d3616d325d1d5c5a40073e347c00d6bb6fb005f1bc73bf18fa535e7c94ea06fb22316b80fcaa0b97d78d77f99bd66ae675db8e9096e6e1567182b2dad01c7546dffef1da72f8d8af7843bfe45d5ff29b462364601dee9e9eadb5ce77d7e39775a6bb1d8c473e47db060554cd61c37df30e535aec6db222daf839dc727384000000079ff035363b698ed9748602447e319cb8b1b615b387b944e46ec302e2faf86e011c64e1d8933e50cf7632c9f00ab7d11c054ec710348779acc15fc1d54738666 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88DFF741-584D-11EF-91F6-D6EBA8958965} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403a695d5aecda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429589418" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2628 3032 iexplore.exe 30 PID 3032 wrote to memory of 2628 3032 iexplore.exe 30 PID 3032 wrote to memory of 2628 3032 iexplore.exe 30 PID 3032 wrote to memory of 2628 3032 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8cd88b35cf93a715ac1a503ee9af5f18_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b323c9d9a83b176db5bf791640fd46c
SHA11ed7b2f85e0b52d1ef881d38a40919668e681403
SHA2564c681e76b890b952a14ae3fbe511d1aaa02d5b06377ac636d1b0dde247aec046
SHA512978b2407973401f65e33bf045e9867d11ffb9f2e7b24adb1378bb132dca28a8f2aaa80b18089ba1956703d5a3781653df1f8a48cb9e8a06fef0592dacf0e4ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58495ac89b3ca33aae0dae9e37200d18e
SHA1bdea29dc1ec674578ba86200c03487660a188dac
SHA256f8d31714e3c8c2fb9f8cf148f8cb6149dd1840b1a5aef7b5957ce6e689cfb3c4
SHA5129ce340521451a0389fbe12a9ae21d99c0f14a91ed23337f7b6542836d6689394a99f68428bf2a6bf8b1283c6ece13239ed9022e167bacd2ffdbd5b007dd5ff55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520cbdaf9f542cbfd0ea0f7f7b55e1c50
SHA1a4c90ddba3370f8d21d7f53c165aa909e1ffd7c6
SHA25691130c6cfa23e18a385f19aa94080608f1937fb608bb3d55f27d69922fc09c3f
SHA512425d448325c8bd0a1c7bf4c22732968d3d5369331f26c98a1f96ebc8a634a456c3ddf8f07c98e81ab635410d37d304f19bd2eb7843a426b70acc9d8862588ba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bb9e7ecbfa3973ce1f8caafd58868aa
SHA178bb7d300a1d773789a40d11d517cfafef658a0f
SHA256b1049e3171db174115eaeaf38a45afa76c65e21fe4d529dd22b9399fcb59a27c
SHA5122b116e1bb1575002add3fb618971a808a577361b92be955217e48adb50431060c8d9b98b01427f261e10879e127978640d871e231dc49f0ed5a74c06f9bb12d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6529ce0fc44c1baf0ada43b9663ee1f
SHA1dd84ace7ec8ad059f96dbbabb0c8652e96b46712
SHA2560ee237a1263ebf58764249158ebb3d410c5f9b2bfed1abb401fc5978df8f37d0
SHA5129a5623c735a2100454f50d1f590988ab7c387a2f49ae5f9c4f6b8c65cc47cd21bfa632105cc1398dbc992c2d889922dc9d5bcc686ee49a6878004937d95afff9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5350b297478533ac8b0f1b5879bdeb33b
SHA193591ebad78ce9309a0fa55141e0cd7c52fa4eaf
SHA25677ba7a5594136b0deb44e607f672b1ef3dc595d334620e822da19eb10da20310
SHA512fa5c8965fb53da0110921045a683b2aa274ee7e86532bf937d77f5f6ded486c182fbe8bb5593d02a98ae0331114bbc70e10ff0fa9a7b1983d296df7fbbb95bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b37f0ba05d77f13debdb08c7f1533cf2
SHA1d3bf6b205545c00c23cfe2325774fa1b161112b9
SHA2565c74f46d4b4c13b1447333399aca8da44a572c5a5bfa5e3ab5d646e6f953ba03
SHA51215d0b3b9dc229bf9cbfaf2b3f42b11ad217698b2a98492f8563df26b49507de54f5debde9a8f6320c4976e452b8d4b9d3db484a6adb0f50a23694f12b8c9a212
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50464f5dc0575ddb0941758f1efff0fc3
SHA15fcfb332620c0edb4b74c8bdf1c6983fb9001ec8
SHA256a05b3758b381ea665a386a65572894182ac5954ce9f678113dccca5c2244dee0
SHA512568b8c4be2e04ce1193f06c792b624ee5b18f4fe40e63b0175db430b112f1de4d01ffbd75017020aafd97701ae108fa6e3059a0eb3498d8408391ddc7e0f0fe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9faf7e8f04d1b67ac9abef9699bb48
SHA15d02b86f14fd1a1f0eaee8becaff95d6a3ba6a2a
SHA2567a059d8546127ece81e69e5303d25712bb8f6030158cfee449b88a7aa2de2def
SHA51279f1ad191d099568c41b286ab9155059857587565f5803405e21d7e616d03b4fb8296de96e356b9cff0277bd17421f384fb8edb89efbb2565536b05f137e86bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ae6825223fe9341663dc93ec8df7026
SHA1057cd068ba94d65a242bd354d50a8f2dcf8c1c86
SHA256e61672550c0f6b5434b391ac48f7dd4d6f3ea72ac268fd4f40264c5b50899bb7
SHA512ad5391ddc48f55750871a8c253dc904a5feb1dd2cb316a100c3700dc5b77351681511c854970cb79aeaf76b46f8c443817e3c6e8662ea3f5610b04aa09802d42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b37381e2833566ab4221273e98b2e82
SHA16a5ec833d8a760dd7d79628743736bb4c224b33f
SHA2566ad5cc48281d7565cda2095c43637cdc48550d8151cd68ca6867c8acc4732839
SHA512d8be706f07b24335a9345c36fae15a3eae9af18dc3eb824cc4de1614ef7a1363f25f841809cf706901da31dee49e531b9d8e328694acf5c0bd2ff5df44955c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d4f9445931951970cdef26d7bee7d8e
SHA14f8c546880d5ad15fab2866a2edcc5ad0d220dd2
SHA2563f5ff7e5bc0952392bd057baef40fc96f96d675eae74c528c419a4307ea107ef
SHA512faedb852cb6074d06b20b5925628ad12c574cdeedb646b1fd2a66222fa15b9620e584dcf570260f90701d25f337951e9c4a8ae53b8e20dca31ea6bcd8043cee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d85ea317a5715f8ff5286934f4a74c6
SHA12b86a6a13df113ab13ed917eb2c656f81c38df7f
SHA2566388216c306622c2c752e8a99845f1c38622b05623fe2ac4ac180562c60c19de
SHA51285dabe170d31b7d863789e651fedd92712271498b243db4174b19b3195d2b3bda406c62be7964ebc45460e4834fc8dc175c556292c60cc975c0df437b5c26216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f2e9fff7591aec14baa10f4a0d2c3d3
SHA1b852f79e5870d9214fb4cfa286c59e63f63572ea
SHA256db2290d02c02d87d8819eb1334a9c721018fbec4400addd1187160b5e17dcb02
SHA5126c8b8c7a21b1207903ce3dbcf74986a93219b67e9aae4fec6a589ed6ef0362119dbaf1eb344de554d7d5c8a902ebd3ccab277a42617491e97f5bd5c354d7edcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6cbb39c87307119aa8110bd831af572
SHA1aba85ce3d0f92ef8b6d620fb2f722871a3a1fb2d
SHA256640904e6eb6fa17eaeb38b44f6d8693742934527cbca97f13165063597518905
SHA512f40bd5468f86d6c5d631ed5842c196a229c0d3f8d3cda70474ff429718282659053d5cef5d2e69853a30fc8400fca8bcc32d46909697ce15eff5eb478cc7b707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a5ea8f4a129af4db62d50b463ce021b
SHA1b32f48fb90d8269799a1d15953dcdd300779252f
SHA2566a6e74e40eca787e67bb94c003f127c9f7dcff42f8ef5f48883075fbfa4f1ad4
SHA512754cb0e19cf99c37cd151f3569be94ddf1cd58040d1669c308fe82892bf278be525cdb49010f7b50b31f798edbbd6dbe34fe1eb9271e2cd9e343514c0cd72e8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3ad54f93b85f6e4567218cc6dabe3ec
SHA1e3512d7110a57614350a36349731617452abb85c
SHA256d2b3f67c08fa6db3e1f20a4928db765a8648c70a0aeab3344afc1444a78e9813
SHA5123bf9623ba0af170f0be4d112846bc7007faffb9ad0f28ea921ee1f3df73cbe1ba6d30f238f2f6b1d4b332b78f9ec39a3fe1afc276179612d62d81f74e91a35d5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b