Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
8dbf6430bf965ac43b65b1b81e6f0f12_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8dbf6430bf965ac43b65b1b81e6f0f12_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
8dbf6430bf965ac43b65b1b81e6f0f12_JaffaCakes118.html
-
Size
32KB
-
MD5
8dbf6430bf965ac43b65b1b81e6f0f12
-
SHA1
1731d14216d69df7eeb1445a4b06ab960c044fe6
-
SHA256
47679bc13240eaea6ffb8c74c5f0a9425e4cedf8ed03a7f6937b84dd085ae44a
-
SHA512
cad2d2110ab528ee799698067666f8f3349d30b8d39ed3f52fb61dcaa83a937a823e76f9c2e3f3b1f79971cb5c9ffa36e049ad369f5053d72d5f6b4643d774d2
-
SSDEEP
384:SITHH190ELEq6eRz3aO7O3O3Pm9el4BXGh8z+Z3p5TnqCl7:S+HH190ELdNh3aO7O3O/m9e2d+jXl7
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002dbdea10f9b4f84e3ef9977abfaea1cd77f2c1ad490b2ae6a67496bd10887fba000000000e80000000020000200000002d8aa9875d8f86c29f957622560240e2b0a871cf127074024d4f4014dc83ace42000000095fe6b545130ff66cda99e98bacbda5d3cf725bff8b0698c38447949032aefa5400000009a21c0b3777f2a87dfe1c2536bca01d5fd88abf3319a9f7556238e0a06c984ef46b4bde7fe16e78825ce2ce583a4c7995c0d999e01900013f8655c17221f7949 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a9fa65bf0a498e9be4639e1827fb35726ab6e9ece8629688409460b58a4274e8000000000e8000000002000020000000b6aefd14c0a49607c455def69cdbce652fac73952ef78052d9a3e7dcf6b3ed5190000000408afb9e544b6fb03faf50afec11f1fe88bcb54ce29c8935d2747ed6ea5ae9deb2dd12d37c95a04dd640b8d426fa665ebd17769f6a1f8756a0984f7095904b0c239c8989266d8bd9423a938d8da5d4a7152fe8082984f9a7ef8e7d17ebbb5208eb13b7b1491d8fd474c9a06eac06ded9dfc8aa4ba7495bd99d37fd91a75c3942320ca0382312b0cedff9820b177744e6400000003dac19f206b1aa51d492c5c01b180cdbad20aafd311b327e677d6a946861692cf8c80642572b8e50de141dcb3ba9d33a0195c26d7d4e100bd29c36c35f417ba9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429607596" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBBB5AC1-5877-11EF-9CBD-4625F4E6DDF6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707a53b084ecda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2116 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2704 2116 iexplore.exe 30 PID 2116 wrote to memory of 2704 2116 iexplore.exe 30 PID 2116 wrote to memory of 2704 2116 iexplore.exe 30 PID 2116 wrote to memory of 2704 2116 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8dbf6430bf965ac43b65b1b81e6f0f12_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc8ac990e4890743458ac1520356a120
SHA144b882ee1ae30df47d087cc9bc3867335ffee514
SHA2561eb5efd9769af47528692699f8242daf7352e8267bd48c29eb8b7a6a0b4d3047
SHA5128bd57890aeb7b571ee864f2cab94bebb32ec7270fdda586f48bd7f4ed197015a84ffb8cb11f8105980a8bca4515f1fbffb2de4775dd2f3d3e9207d40004e1b9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580dd69fe0cd33851df8afbdb049221fb
SHA1555c91b39631f2c3892da8314151f02cbd58c33e
SHA25667050d6a5e6866f85a9c24957f3651169e8624006e539a2091f79b3e9df47945
SHA512c61cd8472100a86c204d94f498fd57d115635e68074906759de17c11fea618b4bff9c8a116863eca1ee5a11d92367cfff0a2d94b21861b64b6c29c4478eda9e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cedb5a681bf6a7fca75d97c20439872
SHA1d9331c06e274766e37257f0f0f9b22cb1faef23c
SHA2565cfa1e70daff10048d659cc7b5129dab99f2eec35af5c14cccb379542fb3b001
SHA51260348672dc1816a4574f266d5f0998b5204f23e58b832adb5a624b9381c1beb8171bdfa97a66e0b9e8c512b14e293a65816c42fa54ff465ae281edb4872b8374
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572172dc5d6fbff0e37aebbc7d975d04e
SHA15b69eabdebf524a9f26c82f5ec7609657c9bb192
SHA256b7e5dc5f96a83b90bd118e8c6b39125c356f80d02c917b684927ebe1bb4b29b6
SHA51283bda1b2b5d7af5d78611ce334309557bd7d362978d13629fd37ee9c832779bb11013a2dbef35db93435eca10b19a284793533290452ba1b21d103ef51e4f951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d252b3631804c5d68067f95384a6f2ca
SHA13c942a59756ec4436b8e7e59b77bff47d6bc52ba
SHA256015064651791528192fcf8d6e91bc6e1131ce0f5187c8474e91175f148e39510
SHA5127d164899af60aa3c24804380c67f5ae40d0b56320c415d9d4a95d7c11a81c6d0b4ac1091912b7057b6c80c93a01643501529fb1b59b0b9a754551aa8e0f06a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8b73bb9d85a3eb2a890f11a826352e
SHA1bc9d2298d2249b341bd0060eecc926977db30e8c
SHA256a9dc90dc219f672bf19f99af7a3f69e389d5fc8ec1717ff954f9e6f495b1aa92
SHA512fe1ea48f183c9b31a321382abbf05e3ea74e987354f0d06401871c620263404efd3614da3566f1ba077d05c7ac30189dbcc2fe27b3c90eebaaad3b8fd03871ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feb4013f81a7888e5656d47dbe6bd036
SHA1a7847da8fb45f64d895fb5e7e50a445350c5fbe5
SHA2561105e9e0f156cad97d6445914a5fa8660a28767c0931ed9c0981cb97fd4210ae
SHA5120c704f23630f1fe3c1cb5cf0c6e2b1cbf3eaaceda0a2d6eddb88dad862aa16a3f9386abff570d9fe52834783bff44970e492835c1f58c771be576bac6a2bb424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b03bbc79d367d6569f02156764de4db5
SHA15903ba575057bd86bbcda98a9547a68e066ceac9
SHA25697abbc5aaa883752081649811d974439bcf96c149fd9b4c9f4757d9474a08a05
SHA512927c624d794d803678253a17cdc92f239263a18337be233534ee292f415c4c5667d29753fe7c6a80c9bb022193b64085110f978b81c5c8df964633d74bc2a2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d7a057ea2745710d08f916e24741b6f
SHA1c4a65a5129b447483c7aee5dc86fcd34aeb0c793
SHA2569248c799fd251d6b4b51feed16ade997e44a1daafe94c26cc0968de797d653b8
SHA5126ac5dbd083d92152ea8efa46030a18499e8412b2950915cfeb22952abed27fcb5a157b37dfb1d53e377f23d9821e7d40cca8505ace99f51764fbd0a1344d87ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5052d20b542f1a6b8121a233001be7f87
SHA1974898399bac878530080fdeab1a4ae9e2ee287b
SHA256e180e4dcfdf857aaf5c30fb90c6e80d3a4bb48840999d7931b277be952cc8e92
SHA51254df24dafc184eebdc1d4ea10a2b42c061253d6a2b0b9d6402bf83e8139c8cb342b6f27eb9c4b6a5b7f1bacd898782ae9f1b5cffef9b759ddff59c4597b7f885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa2bcc4adcc7c02a33fcbf85628c8393
SHA181fe9fc539847d79a20104eaf4f57bbf5e13b293
SHA256ea3d5b55da82377f8ca8c78976004fda7d71d72774fa2911c39c74a2d61c50c9
SHA512945113fdddf5acbbc2a1040c6f61a771f15fd4b69c9a44eef2f5b821fbf04e03106ea32d872f890ee0f3b8f9e9aedcb4cd65341871585cca37f5e6de0ffd0ee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a0a83f0a263b2192c9514caf531ff3f
SHA1b6fa761184b7429615db4e79547b302a9c79e96c
SHA256867f9140adbe96fb889fc8086e1eb6a5d0bddf3d5c2db544ba2d801354a7a2c3
SHA51286fcbd5f0cbda478f59b5451eb9652322a8260d6af22353ef23c928d542a66a6135b5eecef39f111d51a124bbf9a9dbfab89b9198e0f0d6d13c5ff0aaef5497d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bf0b14837e98ba02740e41a0563ae33
SHA1dbe6abd76efccb69eed40eb309d99c6f1d70d619
SHA2565847b6dddd49529549639bec22a1895d97f2a48d20474e1fe47d2cbbda660a90
SHA5124d0339873418ee58096c2020f5d598ef03be929382755120e829eb6bbd398035207e066e8e21aea03fe545bb052dcdc67c055df454d8f1f62182e2f4cbdf6896
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5000c43c44980eb4a0b1eb3934d37e073
SHA1c05f4a92483bf4b23c69f391208f938903b5fd23
SHA256a3cbf778d2ef43f0df63742c12f9b5d47098f7677c3cc96238df5a6dccfa5b04
SHA5127efe100ae873e6f0a17d70e61053a3d14ff20fca31a28339b934e3e66838ed19b80c075ae99385627058de92f10bcfaffa5be9a6868acada3c64057fb86f1689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5793f7d6abf47888dbc1340d263c8df77
SHA1c6b049b6eec507ab8e60f19402793ac37782f3d8
SHA256b29c518b623e782db6c66bc3e1972cabfc0166cee76a2166a9d45daabd01421f
SHA5123f9c5a3f7f5225713dea682bf6979909eae8e964331a9fd84db1e7edec5b66ab2aad8d5fc6a09257061d040bf6798ceaf2f857a6d396c2f46cf0bab09f9b9324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5f938fa87993d5f9b6a1db20c8f4ee8
SHA1f195da4d45241f046e0b4e292b550cac6af37f4c
SHA256efd02e66dbe5e691d98a4d2823d2ab67ea78f3151abc06465d7c7a358ed56003
SHA5129b2c269dadd867a5e05de52aedc1da93ac38b8d9eb9deb312b72683fb0a855a330e820a9dbb27794fdd23eca32e330a2f84c091d1cf8c306eca6572183b51acd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887fcbf6b2a3b6c86a85478fae602b76
SHA126f36316c0f4c732c97797676602fd16713c6d26
SHA256d120c70b20dcdba71d378dca11141a83d7141cb0fc8b76d8ce6e4eefdd5fca9e
SHA512bd85f6f3eb3e161db56125caf2ec43cba408cbbfa54843e985394aecf4020732d212c6b030e21c5bcb4893d20abb34bbbcf7765b46c3784966ba725af25f97e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d920de92ce9b4c458bc77084256268a
SHA1870e46af608de0fbbb95323fae574b1458b5cc05
SHA256400eb147d4dab9bbfbb989f57f67e008916abceccdb6a31e7859750ca4a6cf9e
SHA512185e4de41987067ea5c003d816beac2939f950c9ac59a9af23b42dc0a06a28e6eab4a9d34ab6cd287336c0e20d73b5749d0d6bce2df0318b767309a674dfc5ea
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b