Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 17:01
Static task
static1
Behavioral task
behavioral1
Sample
a361bc457992107730da9eca3977a1d9_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a361bc457992107730da9eca3977a1d9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a361bc457992107730da9eca3977a1d9_JaffaCakes118.html
-
Size
2KB
-
MD5
a361bc457992107730da9eca3977a1d9
-
SHA1
ca34b03d6d641fee18f128f1268411c4cbf707f4
-
SHA256
ad609bfe9a33aa09ab3f246e6fb03496544a51838b719185069655c891b3c520
-
SHA512
3433bb6afe4d0310fcb6dd793cfdb04fdb39b9e51fdf63d0f4bed28da90d1f90b71f58cde6f035c1d8111861db11cc301ac4a5d75f158b7807f44f869549c037
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0eefa3bc7f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430075978" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65C8D621-5CBA-11EF-96B0-E6BAD4272658} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d0f2156d7d75c4c7b291cac5087a9d44a6cb353d649c8f0f3a230058a8c3eeaa000000000e80000000020000200000006f21d917f588b944465a80f32521dd9f4d5c542209566f5b8fb703ac4a430d9d900000006ae25fbbbf419296d817b3c401dd1f96700bf6aa7c555b3bec693f34296e26f85699273c31e1c8c282ed01c7debd544be836446373bbf96b8f21db71e977fc8f3bea82f3fae61e985ae113411ff9c8a1f1659804ff3b7550187f53561b67b121a9f49eaa5ee02d3689af95f5649fcad9cc288fdccce33d69c8e9e50ff61560dc6460abb0bcf768320fae1cfddee048fb40000000ae956cc570e610a6a139f7de86d320d63a1dfcf2d39fc2aa9f15e417de9f35b9945086d76cc6265695ae33ed478c41368e8533d4e9406edfed4ee8e9ce4c35be iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000001424674576065f1af49986d0440852b5363c70df2987994bda334fa739159b80000000000e8000000002000020000000bb950813c39214d1d691ff033b1c8e95c32a92edc7e884412abd4cae827a47c22000000047edb75dee99084d904f7b8d6d2fbceb86f9f032787853695d627319519f053940000000c9da7da7b93c5fe632146a3efd962149ebe5ca639cd0b460bb046c56f485b06772b8d14813bc1faeb2936a73236652898d180904635d80df3768f561073b9ed7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2420 iexplore.exe 2420 iexplore.exe 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE 2188 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2188 2420 iexplore.exe 30 PID 2420 wrote to memory of 2188 2420 iexplore.exe 30 PID 2420 wrote to memory of 2188 2420 iexplore.exe 30 PID 2420 wrote to memory of 2188 2420 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a361bc457992107730da9eca3977a1d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2188
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da4750f54625f2d8ea39ac330655572d
SHA1e03997d0820949263fbaddd2d8b1b59f5b58a24a
SHA2568e4cd99b6c08bb6163cef10ead41de25a6666c837d4ec1a7f9e26a462be1b88c
SHA51271290d8d4dd449ab372fb4b6156ee8759053fa8a12f5fc819568b64626c3437dbcfc8aec085c125bdd1bab015194497434d5aea07c348db65e217954010d2729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585203fc89b34bdd468d6586da8c86ef1
SHA177f336fe1a0dd33759f7b0ee17f0ed68f6365f65
SHA2569289ad6171f2d251ac9f30fab66992c3719ea88146a0e27c55a3f0a4e7af30d5
SHA512eb0f3ed9fa56f1540351dce8d37bd947b2376a14710ab790b50ac9a23c38145a990822e9d0a65a46968a95f248172d50a2e45cf3204bb50c8bcdd0a7644e4f7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa0af02e6823e97d43abc349d0f458a0
SHA1689359c87d9379a3446a709f7dfdbf5e86e8627d
SHA256f967930066fef8af61d9edf5c1f406295a15b05445aa9d9417c06883ae35fa1c
SHA51265126c3faffde6e6658a3a664dcf5579e4305e6a21baa73d2b30391f0f0d4c4fc42054e6f9c25a35defa2a4e30b867f772d435ea675af3afff79f436b2baa0c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4455555802c98b06857939b49681fbe
SHA198730b00553544c3d83a1dbf10e317f0e0eb93a9
SHA256b2db8c407d13ff5d9678f637c817ec8b6b2facb459d08b90b0029d08b6fb0b37
SHA512de34027ccba3c98ff4a3a535c8ebdb82bacf7f7f2ddfbade9ebff10041e14575680d3cb6faaaa299e78184b7b1a29a3a07020c208037ff01255b4e47374beb0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520d94f4a3e900c5d557043a6b2804e44
SHA1b67dc2d9aea22dd6407a0a90ba71d3e4f8a31b9c
SHA256e13fabc750f9131cdd9cab80429ecef12015b62495fa98015b6908bcbee42d2f
SHA5120ce83371ee5176ac01ca39fd4b28efef406c946a6bdd4b39d23ad668bca224529cf57509dfed774b62743408861527a04f728fca70fe5ca58abb21b35fcff84d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a53fff08847f67dce26150b2b9baa56a
SHA1303143ed673652a95b737ee6c32ff98c276b869f
SHA256953e32bb2f0ebc9f40a93659ef36b1abe7947b99e400f9d70bec1232d0ca6e2d
SHA5123ab2af7bc254b7b56a6a653b69d7fdcde3072cadbc73b696e78f16812c976499c82818e3dec4938d08935ff47f74c5e850c0b50b03763a80ffad7c8651207001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed4313e5106f9eafdbc6aa0bbefec3f8
SHA1c2b4e43b2badba900ea02499247f92df272ebc34
SHA2565a1adaeedeb63e89b67511a079acd7c449026814d94b88e84807c40b7f6c3462
SHA51202e6f468a263ee5e53db322f898c1752b1bf982c9ecc79385c9d85e9034e2b1407b81a159cdcc98f23aca3faec659fa26dfa93fda2fed9c922882802472da8a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507389453899100a69859d5d8405c9fdd
SHA1bafc403a042ec3931bea2786040ca858275e39e2
SHA256809bbca1ecca1475e448e32d838b08b2e0c8a22cee07cf2cb939c6a86b98c410
SHA5128591be5592e5a7ab02a5b3c0e9e9cd495a8c84c9cbb239c5a302f4a77f882a14599b2d6908a985363fbe50772e36cb3fa79456609db99858651712e77861c82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c772d89db9cefffce363df91f3ac3e83
SHA16d7f0f724c69d1ce1fd0fd37b6f77098b0e86d19
SHA256f47af864b4fb95c29c3317dba592bc9b57c5d6fdac70ed4960eb5db54c21f23c
SHA512524a43dd8c52b5436ae21478f6b62e2665de55c962301e52a3e8694412560637c5c0d845ccd8fde7ff740ac646c73251c7655ca4e1ff11f3cb9f67ebec0e1451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506fb6d3200ce248fca245814acbe8cc7
SHA1849fcb0f3d66a34a098cb5be4788b9e366e107ca
SHA256a8b9978ebe6f03af8a9184d185c627746e373f499fa29fc01767f63fdd5630ae
SHA5124d10e7003f4f1e98670b819be3bd7ff56988d26d6b9a75ea521dbe5db51172039888073f52badde6b62021164dbb126ec42426ec65f68f3562c6e581592a364f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542f5bc6e951f0379329f32592ac5561e
SHA1aae8b1ba85d5137bcb75cdd39c9a2211de40ab4b
SHA256085943f1e1bc0b4532bee70bbaccf69a82f9174f3aad11679ae334138bb46baa
SHA5126bd2b12db2577edf3a5ce3e26d5f9b90a70a56f9f6042f8ea615340169e123f6a4418932a9fda979c23a681906de94cb3d0f69cdcdc2a96254a359381f6afe6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3b36dec4503b6167f144033ad579430
SHA11215a9e0c87347fcd49284bb669aa1876201486e
SHA2568d012d1f70211ca6b9ed2b80f46571e09f77f815706bd3aaee0859dd20cda391
SHA512038ededb9c752d0e5de3cae2ce4e41fc0f56629779585ac570a496420e2268cab4129cb3e15d415bbd1bb747ea03e67174c31842cb4641aa4c2ad775423c51a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e80f1d42729cdbce083df76df5e565a6
SHA175b9ddb837d7e14f355291d9472d0ca297ce00df
SHA25690a8c17f9d91acbd4c4cf8be3284a9bb7fd5c3e9af18f35defb87572addcd7e4
SHA5125f5e3375160ed36ce38b85634032322afe85d5b5fddde401e305fe8447da75842810b015fd9db1c0b257ce78dae13980943ee84af9c74b636e2c7c53613672f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5603be4b3615ec27a55f9358aa7dbdc2d
SHA1f475b8fdac9b46e3aa30f2516a46a34233012322
SHA25647fee4a5bee2e4647943295ffe0a9af510f15b5a867e70fad2d851d51b4b7699
SHA5125d80bf9603ad3a7e8bc3588097561de1f2041d8b8d9805559b79fd13fda0c573b5be1980548e3ec844e5bb916d9d8e72c16448c07d0531cd66f0833c47a432bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d6ea772d4425d8ad987677b30194900
SHA12d111167374bde1ec8c515af09da55208e0e057b
SHA256455589b2d11ddc2c38007c98a497910dcf64db3e51667e8250c9295c98c48521
SHA51259851f2b75926dd3e419f744583c17fc99b872d107d4bfce1c814252bfb654569a0c72747d6cde3f765ed5fb532d159eded10141a319bccccf4b450c095da2f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc2241213e0bb0ba9e8270752436cb5f
SHA129b35a313100590094ae6d8a2dbb5eb899cb6147
SHA2563074e89d15d8655c8f61370c31a801e86ff6a3f5190a5337ec9cff9c2a4366ed
SHA512b1a1e7dd45be161ef915948840407acd6a4538c41ce9fb691ce9cd35e0a4d30059524ed68899ced0070f8205bc5736ccc335ca6777e03dde2b13504c60afb380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e03b9c05dc9166f08f62b7e4c98ac8d
SHA12f11f402f0e0eaae2ec4cdc62c6cb4beaa8f5841
SHA256c425c74c73b6758ebca66d6356f4ca9d806634b39ff2dd79a7f9857f7aaa4471
SHA512ef2a04f884e147ec0aa9ff4908f26935555e4b9e39644dfaae91fb81d9abfca7671b7fdf01467c5d3a8487151f8d1ba9bd4f6eb4e743cd3693af7e053b0845d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518bb346c28721d9521a5ba7a5f938157
SHA1bd4157a988f386b235f32bb96ed81c3c84deae97
SHA256179fdce004392c6e41928596fa4ee635e77037507a739b96eddf174a65910ba4
SHA512d4b8f726fbee67fc457a64918dcf685614611fda1e6188966d87d9b8876e180c3630029fe1c13fdb612f2f4fccf6a20aa173c755b827a8769fa31860eb291574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebfee838861154bbe7f815aebb707e29
SHA1872708d541447f886fc717fc20b1ed8dabc3af43
SHA256a1c5689b173c37c752d956b5f4b2238ea4022d71ab5ebff9d78c8a654b29b2ae
SHA5128cfc1993042675009a8493e9de47b1e5a32ed409f727e745029482738c78957b365e3b8db6e691938bd445a4a3b134ba0fc093c1900e601fc5fd647726c996f6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b