Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
9716f47153cd3edae02f10debe15dd1e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9716f47153cd3edae02f10debe15dd1e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
9716f47153cd3edae02f10debe15dd1e_JaffaCakes118.html
-
Size
2KB
-
MD5
9716f47153cd3edae02f10debe15dd1e
-
SHA1
88258451b501e77854998462507a30a4c6be7804
-
SHA256
3cfd72c8f244856a04b38e511100bcf6aa0243255298d1d7f8a3537d2042e880
-
SHA512
c8052ab1a776331792d645ca2406a8d97224d74a8ebe6c90cb7c04c6e59fd68e61559604bf942b846e2b3f8e6e186a0fb38ac1c0ca053ae7fecfa3d77df6cfed
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000920e2c75ec2e0a9f53ed630d478550db4f84c39c873afc5323d3d61eb881fa18000000000e8000000002000020000000dfc25cc8cddd250b4fc652b891c35c165b9cd1ba7937b136b0d2669fd1cbb0a720000000cc8a5a2ad6aa837f9e886bdf6814ee18ea4be81886945b5933a4b65ce6220b8040000000edb5e1db03d4db5ad1029b4b9b9ec4a8fee09bb8763c8a7caef53fb2ce3c0ce5b99141162884e1154e5e9f7f127b5d0e9657b7c5c22a4bfae3543f5a67bf4138 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429820100" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A206EE71-5A66-11EF-9D6F-6AF53BBB81F8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000005710220d6b5a7c071e3f0ee050e694dea8d183efb7ea7e99b5b07ab37cf9c9f9000000000e80000000020000200000006c756838a0c9ef9020cf747b6750df7140c2ddec20d4ca59988d0ad14fbd4df890000000b4bbd796e2740fb11fc3d68065d3973778b0ed9f24185b6d4539898ccaf9cf4cb79b06ddb9b6e19949cdefe26e12123b0acafc8415f5b0b3e9c5361c11ec889d1daf5aeea16789bf71895b61691880fa99e2a0dddb33212a41fb7d5aa6156ee90b0aff4f24240dbef26b040db44179be3e5edd0f0df3bd7b1f094620684a5fa7d96c2b7011a3428ddd75f3e5479429a0400000006ffd6a20e091a214e3b0bf065c0c23d2f40139c555b3b9b5ababc64f9a128edfa595d2ae8efdec5a53a661336cfee99e1f09340705e9bd7d22ea7a14922ea85d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902a2a7873eeda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 3068 2308 iexplore.exe 30 PID 2308 wrote to memory of 3068 2308 iexplore.exe 30 PID 2308 wrote to memory of 3068 2308 iexplore.exe 30 PID 2308 wrote to memory of 3068 2308 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9716f47153cd3edae02f10debe15dd1e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531fba5fae68d4078bad3b05d3d61cfd7
SHA10d2a605de8c4103d524b765a39b5ee3bc2af78ba
SHA256a1a32f02cca83f0de7c58303d087fc862d22e615e5a360ec0101a210b4883d0d
SHA512a139fd0d9565a83f887c2100568a84ead326a9b96b19016dd961e643cd3aeba3a2c143a9b155a2f8568eb56d6cff81ca30169946d381e1e83c8b465289c45a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c046c6b28b353e2a6edb7fa14473453d
SHA1a1228d40cff36e084673af81b6a5288d7fa575f0
SHA25696b2d2e905467dbefc9978f8391f9dfef61f365cbdae41325fc72bdda5413d72
SHA5123224581f25b5863d6fe674531f1c2ecef1aca3d096fade378a636f620e6e1765e26b115a686d7723491eee6c6c309295dbb3ca98bd0c22a53f2c63e020c590d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562da5bc76e3a8423b139f254a96004b2
SHA12f1464129fff3260418fbebc0a03c8e53e1aefd3
SHA256a8af0ca61e77bbfa28c1016805297a1ab22b3bb936b2a14c57f8d91ab485bf8c
SHA5120fbcb41be797ea34a0dc82639b8936597b415690427f6b77128d5bf9c91a44594befd028cd71979e41d44c7fe8b524fb8690377900d1f57af64974e2a47176c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4180e8658d943c298875871ef18f17d
SHA1445ef83c42676172add465c117261426fd768509
SHA256c611532d50802965f80a9d5fd093b773f94210fb120ae10f49a08bef6c27b57d
SHA512465fa393c11f54aa2a321f20922bca32ed8b1e6a8062549fbd18dc27315ebc201d63103a4d1595d4f831b7477a5ed185926a0bf59f5378e06521d8923609f27d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD571cd105d73f87b6fa0dbdafbc2c20965
SHA18b3358cd283ba346e5709ef1197e06fee6de827e
SHA2568e96ab54bc610d3d0fcfadd3bb33fdb574d2807403d79a291968716f3f8a329e
SHA5127cb7abf2c2a34d25e11cfb0095b07dd4248f507bdc22430e92a2da5e8163d712ae975a38f1e2b423cdb797aa3cdcb57317b3e2d261091e2d1e99bc08e4c7b01d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8235f62b843efeeed4d2581d701041c
SHA1653c5a1765a81226fd2cae8033344e274009ceb2
SHA256b48ef7095d228c9ebfcc5f394ad0afcb2c6e1d23f2cc555479f194e0e39da94f
SHA51299a5d073f8dfb53ebe03d1bda1b2552e5ea50b0db8f7c07c486ccf8196a32fe09150daa4aeaa61e6f61ef8824f2fb913682eef9df4986fc579df1455d0b60e4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564bb22cb66ae325ba33988e735b39032
SHA1bc801f1e56e8f49be12ee138de7459041718f8fa
SHA2566ad9bf6c0db28061375354bd43d5e6776106f5d15f7c5fae75a08f8c208deebb
SHA512639932135af87d1aa9ba65d0e2ec712127134ea264b25bb6613d07700100a6fff1e97128bf5c0eed06d74424254ddf8a72461298d645f58b279bf783a3c42109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525f8bba0b7a1356c48bae9d155822a82
SHA1beb4a5bee1b0a880272c05fc09b5f447eb7b7016
SHA25619cd5927157e1d759046a25382810e9cb86151b6e816b3f192ecc8a929ae510f
SHA5129c8f0eb97b23453a18b7aad02b4bfc9718431a64460e2636261b91f91436721e30950df993a607e6ee40ea6537fca772a0dc59180c96bd0837122109f55632d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3b1adb8c393be11d562409d3b18b6ad
SHA1b59e73e1915032b7fed6b01392885ac8fdb64ec0
SHA2569de01b9463495d1152f9383dbc6487f5b12259d7a2d7b3047bdbf0c1d73fec88
SHA5129d567024805eeb5d264d7f51cb88c0546480fa8cc0bef4490860080125b4e02752339235d779e2ea31a39368f61c9e934d1d8f24aefed2defac9c7edf6402b8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573a80ca8681be0628c0554316085c1ed
SHA158e003df7f25ca47060335784037c93fffcbc41d
SHA2566b6d32648aefb78bd3b27b0df5c77df2ed0809fe786dae76edf4f4d9f5a1bc16
SHA512b78d2b42940beae36ba80b91bc80e876db6acb053d826b2e8ad26cf171ea783bf1a17612afae1c1b5291419c2ffa94e349beebcd0159b76bbfab6454b6508b94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a470e35ce9ddffc3640db768a124c55
SHA1e8513c81c0996c592c703bd7381f69e909340e68
SHA256ce5d95310e331478dba545509a5a1f133a4b9ae3a9b7e900b9094a86bdc86c60
SHA51224101fe4865d8192ad4ed0f338aea969c782c4f4e109465c17be8d4c7ead55f10adcd277a42cd9d9f1ce4da67f131a850c34aeee912e90b74cf126021552dafc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed8753b85e3349f706312260f37010a4
SHA1f76b0d4db675d3c5c6e24f2d584bfbad37a08ec1
SHA256dbee4ae761df2e0e534a2052019742c3112192c062de4544635c47b9a28e5b8b
SHA512fac0f8e447328003688f983e24c836c98e84d93a99701ee5afadf93f2939e5eb3eb6c9c0cff949a04e68088188b306d3402799c9c7cb9873b1a11aaf2c3ad0bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc2f5c00daea2695cb948c3dafb11409
SHA14bb80a067a886e6f22035c5a4aea8158db554d17
SHA2567122b11d312c4cbfeeb6283f2d2b5e87e3d2e0c9c4862af371d848870233cb33
SHA512e2a065eb94c843376a62186a5d2fbd25e06e85a103cb109be7ea21891ab9137f8d172fbdfb0a4a83982b66d8494720cdaf5a6397e588ceda3c5aef6f2fb8fed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50824b47443930322b2ebff8b47d34d77
SHA11b9305d1ddc4703819a443174d8e89ffda6a7f39
SHA256d9fb538fb5b5844aefd56fa093da6237575605693d4fbdcc1245fe5b97e533b3
SHA5125f1f7fe7bfd997fb35bbeef49f5b6b266c24f2734aeb624fb2227a554a8e788b62577710be514dcc57e4924a9864c239d9f615839942a6b655106feea6d2fb7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1e769d5d79f4cbc9ecfea1ba12ae746
SHA165cba50bf7f81c067ddf5ede4d34d9ba09db52dc
SHA2562cb99d4d36e4d49ee6ac26bf5d2c322eee02aba065df79b7c6665e2225c360f2
SHA512ce4f1d8851a45572b94a44270569f8eed512c2bdb065d8188851996792df9e46b7cf26a0b7652e13e72219a413c18800bf42e8c340e2739a8fb3ee0fd914c80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bbda081872ca5632d02c1115d578b72
SHA1ec81071644f83c0458df54103a522463d93f8d15
SHA256b241200ca2b59ca0687c3b46246f1713d73d61eb57e4e58ffa1a72e9bbaae9d6
SHA5128df4368b690acf84d4935969307fffb9505c755d43765967292d3cd3f77e8cd032dc66b74353ab9a934916b56696ff5a138db9829a4feff7b0e8ceb59908439d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50996f16de35bc51470514fae01a40f60
SHA11f809b596a4b9887d0ed49c7aa73032a822650f3
SHA25684c65b3392aa032531582621150830021acc82630cf61312aec0cb96350ecfbf
SHA5125d0ff438832c4f996f409fb425cddbf8df36c3b51df8144477a4ed95c9bffb01e8a200584b4d04d79991d2a0ac687075898e22e3fd4975d0acebfad958631113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ed3353d292eb39d43d69cb1844a0800
SHA16098c3786642736aba312da44d19a636dd5fa8aa
SHA2568bcf907072f6460b7e19b74403cf7fd1e178d0582f1ad0ee32ada46fe0af689d
SHA512c307c1791b3ba1f3244d93b61c6f338895544540eda7e993afdb980904f17e9b083a052e8d0ffc2eac430cceb5081bbc167a97e9db8a8fbeb23b6e060df295e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5738ed056951d761dd79dc97734cf891d
SHA1a85629622fd7b67983cbaf4dd9cb5f2d6bd4d895
SHA2561cd00cd6a979c714c5560dfb480c3bb530fb5cc3336cd4598552ca1c6862f937
SHA512e249a011df0067daebb48c4857b6cdd18835f1cff1727bc64af1edb72ad1af51c4263b20a0c43529f5d5d0979c4082cbaaa947e4394a3ee1def787ed0125fc59
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b