Analysis
- max time kernel
140s - max time network
142s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system - submitted
17/08/2024, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
a301450257b0859e6402c646a8eb7202_JaffaCakes118.html
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a301450257b0859e6402c646a8eb7202_JaffaCakes118.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target a301450257b0859e6402c646a8eb7202_JaffaCakes118.html
- Size 9KB
- Sample240817-sdphgsvbqm
- SHA256 2cf252ded5ec995851c8de3149f2e34907710927afe0b73b8ff42c55c70d66cf
- MD5 a301450257b0859e6402c646a8eb7202
- SHA1 f1393cb3843dcb97043e0f7c8e2b6ead9d8c66ed
- SHA512 4d272c0c258f175e22fda59a8eeab74900cbbb25891555b65e7054b1ee44c50c0ca5a64e697096b3e4d4333d309481e6e0bfe0e719d16ac5969651d6f8eaf5f2
- SSDEEP 192:SI3iISUe6ollw6Nl4x1GriUgdmYl9ARjxaPvei:SIRIllwclEGrivdt6GX
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C182401-5CA9-11EF-AB78-F235D470040A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ee43b52079129b53c146c4d7d4fbd50f2b452e47ab29495b2b3b62dedae1b33b000000000e8000000002000020000000ce74ef1360850e666c56f9d966c5b8ef620c21584295a5a7bb8c6d7d0b0b52e490000000483e1d26a61d567c8d1ab92813049ed2eb8527d35e6f60285dff8fa0afb1b35ecbd6ce662d1836ab5e0db5790c987f66cad51ed81f62f14a2bfe0418b0ff05787b920addb0a3113dc24d224f6385f0bbfb95dd6b15f33ae4ef2ebf6190f37d14a9a1ceccf47073907d8095f263cb44286dad218c7e78f7a8e6e5b05f85b522c714508530e1392f5d5f60f41567e1ae8640000000e9fb174d41e239dbd846baf699e6a6a26740e2ec06c360230f311371494408e2dee7b2fecf17735f54016df8389bc5f2b6e28af8bfee1bcb6703641c5f16a28d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f074886bb6f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430068715" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007230995e7eeb3191487b77a9ddada284c5af044738799926de36e9d22e9680ec000000000e80000000020000200000001ecda92f2027e4f8f218ba3f7cd96603b19a16cd0151c3330fad58a6a336c56a20000000e81b9dd749819fa6a11232c50775bf0d56e851be47444c900d946ac7b0b2172d400000000091d933db308aa1296ccc5645f94a71301b298dc195946803d70fa8492dc692029c172734fc3b7a09527bd612905c41c7466f5850866ebca401fd6787161632 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2036 2088 iexplore.exe 30 PID 2088 wrote to memory of 2036 2088 iexplore.exe 30 PID 2088 wrote to memory of 2036 2088 iexplore.exe 30 PID 2088 wrote to memory of 2036 2088 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a301450257b0859e6402c646a8eb7202_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e0d430cdd33a2582c40bec65f227c1cf188f60dd82b12e04b1df1433109972e2
- MD5 0cfd94df4346cc9de71596cd0c131646
- SHA1 356e0eb1c4382ec2f5a6f312af7778c1192fef7b
- SHA512 f3e39496a28e12969d4244d5c3a8cb44a8dadcd3cca3ea8743efdce8ede034ac04f176ca8947ab633f160e203953100cef134e22a03e91e28263fdd4deb78493
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 446d2577155583462500b67b9a2d4daa38834ea735ddbdd66a0fec1f2aff0a6d
- MD5 d70a265842e56f494e29cd38a56901e0
- SHA1 a8fc29802d4314c25b4d6b5edab0798de1f9ad97
- SHA512 ceb255d5ef536352b187e865cf0612cafdc31b2f81eb280183a04dd35f420872d0574b3cf2b61d15b68cbae5d44c951181f41e462a79e8435e531ca03d6e56f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1f30b4bcff792841db8087e251f6bfc0b271ec7da5b0c5668ca5e4dbe332d5ed
- MD5 1a9dedbe3ad7dc38336a5c2fdf681153
- SHA1 cbabd99c5de9275c3957640ba9f0d400707fa192
- SHA512 5915c38b5fa3a3b7d13026ae2683e2362f14f3c4e77c990bd4c3c277738e95f1a088e5ecc34795aa0184b8fd08d0009aa75e3c5111b135657f9140ee73f48fb7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d81aff185ccf1d5ea936dda95153fc4c904433c4fb77ccf96f5aa3b988c2a6fb
- MD5 e6784fc2d47a2ab047d34c37c1648ad7
- SHA1 2e52d63e6b67ddb1b47d666c712ecb8e37156d35
- SHA512 72ee64c54031ed5a6661d67c861cb87a16f00b39580d1d4647a4809e6380e055c072f675624312aa37a2e8642669b0f20dfe3c6c728de5e65f957cafa3972b07
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7066aabd152f2787e096593c8b0f8dbc9cc3c10e1642d2dd90290a3922a1f6ec
- MD5 c4b1ba5710c4b333c906691dda939749
- SHA1 c73d88c7bd64eae5d7486ee785efcabcef295249
- SHA512 d93a18b16ef666b4234a008b2b961be8b64610a59372b88ee9eb6e27f22d2fe7764aaeb7b42fd267314212467eac1d8d3f9001aac6ac614289f9b4a44e7ef85a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 f5fb716944253bbece04c5227a077aea85981cd3d0b64cce08ba2514d0462f3a
- MD5 6a303facde8ae780f0538e6a98c7ed60
- SHA1 4d43986e3e875f44fc8e09c82c98662ccc4fc5f2
- SHA512 49b46dac106cefff7e73e423973a528c7d1e36ac760ca6994a8ed94592f7cb6d638a664ab007f1346c4c20d0a2a0e7944ce9d42039742c40de4c410bc3a13d66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 bcd90e1f76d37cff6e4e148d8644731b8c230f04bce1afad1f5d8aa1e444e0cd
- MD5 d20b60c1d0ac0a9f80f79e5e70be6487
- SHA1 57c984d5f7d07547e9d09cd303a160ee25c98a1c
- SHA512 ed3776918705da2ce90e8957c6346b238303447add50281dd4f1cc66a424c465f8405fbecae583db7a2c6b52953352351c21e79fd687ebd999a1b12a70e45666
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 9b621c780d5add938149b9b06b8061bb7f6b98fe3747a0b9f0fb6b8e2decc54f
- MD5 8c9b5d716215e55e610babab9218133c
- SHA1 94b4076f5f58dced079ca98f632e7e285ecc610f
- SHA512 ce7b9c391c788360083ddf890073c5cec503dc7713aa5c22d3eda44e1f066d4db850488ef27e5e6fa840354ceb0895bc9e0f3a45d679ea41909821fd01383059
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a2ae794e2c01758bfe7f92aaa37dd6e65a9b69e8f3b689c3b4d848853532d04c
- MD5 1185f5c5437883cc2882066eea3fa7a9
- SHA1 a3e53a6ef3252702354ef1c9887722e07b1df340
- SHA512 adfcc55bdbcf05726ff43365d485052088d2e25ac6971a3be3ec2fdcf3c01d501caeabf215de42c0548ad0e0d0e0c8a0aa3b713a16d581d3d1c9684f7a7074f5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5402ffcfde8c88773fde665aef6479a6bca641b56d36854ffbd03679078276a1
- MD5 79dda0766cf42ab8f593fb83ffbb0329
- SHA1 0c0ae4d6dd77f3eb79185ae71c6b36c18e0bb9f8
- SHA512 023fde5a4f86914ce6f9748d54a4f0423adb4ff487c7064720805cafec4def6956259e57e749a3c1d76f2c54792ddcbb7161448a6e3ffa25bbc5c7702d3f92f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 0ec77a3ac08367be56e7678244e7a3ef485db76521d00e94fea0ca704fe545c4
- MD5 651b553fd4709d5c1e89173160be53f8
- SHA1 91afe33a47575204395d4e04728446b22bfe3666
- SHA512 0989eab085339c2b5efe163d8b83f5f6d996ea499b4378d87e51d20663129d994560f402ad489611d9d1c28455bd6d3d35b7e06d79ad0c6dc9a20e11b6a67b6d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 82eb4b19b8371a1222718d366c6b1a77196618b3534e281a12534d369692394b
- MD5 717821925290b51f98ec9061dc3640ff
- SHA1 855bcdd6c202e957017cfbc82861d5c07226f8a6
- SHA512 3a69237e5c47c6b9e8098b4ba9824e73b0c817a3185d7879aefe7ecdb27f2049682c5334fdcf58fe7afbadb8d374ac4bb1955ca541b22d5c463de146fb152211
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 095de0145a6555b61fea4984bc650240e69010522a552b51846aae41d9113ea3
- MD5 e1d7af5e938543d8460b85ab266b197b
- SHA1 4d27a0788a953fa2014351011de8cdc6704d2414
- SHA512 fd04159070348eba29b8555551ac29d90ed59391f90f32c44cfc4db75bc1e113ca9f321bc66a28c494bb2fec7eafee2a9362a5b8794b481163ee3c9d39392b52
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab7458.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar7507.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP