Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 02:03
Static task
static1
Behavioral task
behavioral1
Sample
a0ceb6708182735c046e8e7f5b5dcfec_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a0ceb6708182735c046e8e7f5b5dcfec_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a0ceb6708182735c046e8e7f5b5dcfec_JaffaCakes118.html
-
Size
6KB
-
MD5
a0ceb6708182735c046e8e7f5b5dcfec
-
SHA1
7a0cc753ff9e3c36871b96a36dce81714f27fe10
-
SHA256
3e094bff45303049141ad5ca579aa7e7abdbfff12e1a7d962393002f77e3f108
-
SHA512
39b383c3591f046cac009fb336f958dcf2594ad0fff3897bb8b247a51564fc176c03ff1e50f7db32ff48c5cd219a98115952bbb11414e25d3c6a301d0d74f051
-
SSDEEP
192:ln8uqnGDSSW0nqlO3m9S4ne/JYI5EuuS3e+3cqVpeuxGn:ln8uqnGDnW0qlO3m9VneiI5EuuS3eccJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000006450d69b95f627cbd63bd840ec67425e4921e0fd5e40a7917e81bd630febe63d000000000e8000000002000020000000a47dd72d2270991d4dceadb8d1dc21e24e32b0f5e85210b94b5a46b6dbbdf96c200000002ae82c6229d247b696d498c846b372c72ba074ac7cc57ce02dc133fe29f3dd4140000000edd1d0e62bbf719e9028f2dd8bb9ec16dd8d2dfc8f9ff892674190b8fd1d02943f231100ee468fcffd44b6177029733ee76f76ae67a72f55138f335b0b7f220d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109231c549f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000c1db2e6b6b0b1e1cfac8b7e17b7acea5b42f10c29744d180585303a60dccdf9c000000000e800000000200002000000065d08bbc358664015b61bf0f6b9ec4f270c0be6d77333015f0265e49ec058cf990000000b1eaf72291824400dc0c4b0a1ede7eeed6c402d206a6e8ae5e9532f00132aa78f493db0d9e917520a674841f493d6496c011b037a3677d6b58a8ddc3eddf2c9941a11e46e95beea36ba4bd8d8ef995e2198918b7c10f8e10deda319a518dbe77d511711474ff4cdb5d3b7934f3b1fb6939499b62267fc34e815e92ca523eccb6817a7a4a0d82f5719340dbd0577de59a4000000031438bebdcbdc2681296dd2a24830ab0d3c8712da58f40029599a91bcb4b703320d80aba457a40a62ecb71d69ca9128837a6b006a8c311610671b318ca550c9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEA7BC51-5C3C-11EF-944F-F6257521C448} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430022095" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2328 2120 iexplore.exe 30 PID 2120 wrote to memory of 2328 2120 iexplore.exe 30 PID 2120 wrote to memory of 2328 2120 iexplore.exe 30 PID 2120 wrote to memory of 2328 2120 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0ceb6708182735c046e8e7f5b5dcfec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509d456a79b44c89d4f26270958cfa656
SHA1b7ac3974cd5707b52d87fea7ad3ae460c997f6a6
SHA256a8ab80e33445aee77539be7bc297e64490af39b270d92a2dc17d37c9d6399d85
SHA512258ae41e0a104877af16e55a925b00853ae7d00d9f871baaeaa7653cd78c05ac294e054aaf8ca1b887032a9a9f9c6ebf4a6564339dd9505d75d020e6cf2fc429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549268b2f3bbff258fd119d2b24b5b468
SHA16843ecdb5456c6f7b8918a1f9fb0be1d8a842b22
SHA256357348ab49f3db7bb74f1d623100fc0c7eb250f0bbe7d6ad12f93dff34c9c3ea
SHA51240f04b68e24ab95bc24f48772ec8cd7461a489bf0a23ac70168a1bb7c9f5edff7b923cafc23c50a285bbc16d44af602a5cea813aa77c52e4e8ea41ff7ee874fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf78ee70e61463d0ac02dabfe021c0d7
SHA157c46b7d7d9d07c53021247ba2a31feb295f0cf5
SHA256be4fae7b03a71612e4f545527fff30347a59dff3fe7bcbdf70cdd4817a8622ed
SHA512b18c9e1b6078c749e280129651937ea0a924afabe27d057c15f853f0a9b956d64a0ff3a00235b47e8e24abc2a3c44a744e483516246c0b5a9e398bc122a772cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bd95cf5f3ce7b11a2a5713f165ab413
SHA1e5c41be389f680759de99c2b29bbc7824e7c25b9
SHA25631e81c661ec68d124d3c068d783c422aa733965d7a8e469acfc812d7765de56b
SHA512b5e61da319ccd484a8993d07559d768dd2689c9220cad987f9c2444cbefb6631ebb0dfc8d951bc5be79641b017f335c6296c9131680ca2ac9869ea942f198b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5716a4dc2a3de797b343f7293748f3736
SHA1ae0453d56623ced7743a649f7ed9896dc5a4fe5d
SHA2568fabae19f3966771c5b55428a5a14638c5fd41da09ac6fbbaebf3ce9f32d7367
SHA51270829e71a8b7fe51b8d1092c6115649861f3d9c10cb489e1f2bacf4327585ef7f46d0ab7d3c3d7a16aea5acef1735598c26314f6e018afb6265221cfcf3f06b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3962694845f9a9bfebc4b2b1a8380ba
SHA176a32696a71100bcc9d170b266979e943a6496f5
SHA256930cab7386641675c8fe4a0cae02a903f21277b7141788b98138471694d4fa60
SHA5127f91325fc7b51ace10955e0bd38c1ae15e706b576116e1da021d7797285975343f40f8c91b0da58fb67cf1b55a7b0a5b98b3aef4bfa5c488e84b0008be60802d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538b2b2f9836d9e78d881f5d0ec96b12a
SHA1cdaae16ec25b53cc5fe5b73875b43ce80747a17f
SHA256f618dc5077291be067c20b80d8a34ae4e5a07c7cc18a8a4b9315a325e859ae02
SHA5128bc1bbabacae9934a12a2f0536d66016976a6c45e170f46072dbe3bf9aa4a78ee29e384c49dba9779d77058f5ef079d2d66baef282f238117bf19cc43597c6f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dbb0cb1008713b5a9c00e4be5c47834
SHA12931897e9ae4994bcdfda65f7d207a23170a38aa
SHA256b0fd6143542cd750de757385433f839fe5b1a77bc2579a846fd6a128998d0608
SHA512893d939dca6ed4703430f2283837db0de29bce12ec9aaff6a4005a5c832f8d455e4db953d149ce978298ecc4e700340ac6177d97a73b91417dfc735f20210c79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d0aaaaddc7a6f2e80fd13f5a40d66e4
SHA160a83f63493bcdc05e2b04cabe75fc3c919e251d
SHA2568926b1d46c5ebfa9b1dabc49157c858c3ef5383bdc97ddc540a2c71a7e0ca2e3
SHA5129926589d2822f54d1128548b310451d3a8d6f80572a3742aaf8643ac6836592a269ea30647f8fa0e34ffabcb00a53f5df35666ea57b258293571500b0a2d52b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5089f57370733f544c0f98d10ca947581
SHA1bf1331e169454bd454a8e09f4c784111ece556c7
SHA2563b362f4400d2c1248fa0494831f97edee5e8c0319313d344c735aeb299a54ff6
SHA51260c0a850f82ba55614f68213636bb928fd93dc11cb95d47f29d860697fdfcc5fe9fd1961fc03feb86bb80a76add9bd2b5b57cce03f2570ad689b92aa963084b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5987d929356b6c8d27c073bccfd2bd4c7
SHA1650f9b172fdefdcd3d3d4ca5ddae80b7c0c9cdad
SHA256bba16437dab3055b260e0ef1e1dfa18c470e0d3fc1a27d17faf5af0054a62000
SHA512c1f8c238b2bc39095fd42f86b789bcc8f0167fa27ad242acbfd6adfcd124452e1580d60693d402ae03e3f169cb96e024d25e9e51a346c74aa06c191b6b44b59b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce3a3443c26452ecfb1f8e02199ec3ab
SHA1a59f4f2c9b1907071c6452b20474f4e763515d58
SHA2560091d61d27ff8d997b13bc7f4713d544fae6dec0fddf431ee3913761cbb7222f
SHA512a84dd804dc48d185eab7aa501e4924cf3914a0f89423d0679bc7c32d5caccd526b43971f3e1298c41fbe10d77e2ffb96167e3f33d5abee22cc03cf4569c9fb5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cb4be24126fd2f0aa78ef54a7e91863
SHA12d3d23e844c612f2c4551dd363143aa2497e21ed
SHA256d120f8d91034088065ed009cce3c7fd35868a4a1ec8fa08dd488c7c3ac703ba4
SHA5120ffc3b27ffacb793570a4bf3a9f0f35a483075f7d92c31c1904cc100c76e76b0497ff60296f2f804ad27bccf8075c93142085a6deb45d3b21ce81b26cd8f1d4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f5330a4d91cefb92261e80e697af7ac
SHA193014bf3e3129bdb0961cb0e54d007c9ddc7e1e4
SHA25695970923874ccb33feebc7c006f08d9f0f1802560c6a79d05e548efec70208d0
SHA512bc1e6458b05aab9e8599d4547d96ca5fdbe2f6d8aced673539474825450ba34124a07ce6eb63f11cf8dad6abb957cc7afe16946081db8ddc18104f8c05d9c9ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598d78e3b28e0378d8d582505e50fdee7
SHA1756c14e9fad600bc30ecc3668ebf5e250f2895fd
SHA256f56626f1110eca31dbd2414fc72fff474ca1f13d54ad960121d3313637c6a732
SHA5129f2f8a778fab395e56ed7e3cb0712d37b983ef4e115863869038d443faefeb8bfc5b82a15a974b8f768a548cb5ed1160a5dc79636995133567c5ff94cc7646a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e23da97313c7431892ef30e594f5bfdd
SHA1327f08a6c97e6c7e6aeafcc18ce9066043705ad7
SHA2563e099f61ff3e4e2a0846711e88ddaa0692903bfdeb2fe8c1c323bf2a4f995b6a
SHA51292928c52ec8c01a6ee251db0b62b459fdd053ba32af7e1ccee93f8cff3217574ddbfc304067bb22dcd7bd7bc6dff20151428f5862ef98f7f83ab36b2b29dd63c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a57899c0e21b9fcb8efef2b3c5bb946a
SHA12b6459a1a65e1ef4aac79038ad73da59c09abd77
SHA256f5b350227cc798935fda7d1d42d99e06b966f2b689966f6e5c5c2cba2284a899
SHA51225e5b8eec640bb168c94c8ab3ef865a6a23066f748120d33afe74e2bbc0c236510f4aec16d80c27bef83b902311cf2c88fefb71d35875cbabfd29ba29a05e6b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c59133d3766e171927232e42c4814226
SHA16bcfc879729e4bd2c7bd7d2f22e21c96b4935f88
SHA2569fd9c536c63760f5795de90c1cfbb5fdf1a060d7e797ab5ba0ad254ca5352087
SHA512866b75d89eb1d258df65f4ab3cf8adb477003a13e218881113e81084df77c71f1379f483cad92d2027771e3d9546aadcd40280625ba19e3986faa967623dac62
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b