Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
a36ccc40055531ff790beddbb229f517_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a36ccc40055531ff790beddbb229f517_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a36ccc40055531ff790beddbb229f517_JaffaCakes118.html
-
Size
1KB
-
MD5
a36ccc40055531ff790beddbb229f517
-
SHA1
fe160bf676b79cb5e43b3fe1fbeaf4cf0540e049
-
SHA256
5ae29ee62feb854beaed5f943129e44e2f71ee97df07e6df3eb1d3880e284abf
-
SHA512
91841a52f7dc8cfbb84db7e22a16a7dbd087adf869580c9f0ac9585c6f53d87a9e82ca2f1bf6295f4ec1dde833e9b7aca278803298df07f72803cf0e93d8cbc0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f907adeef1e6a5882c31ae16697b5203cfe9c5b8ed179f17b3ebe3aa7adbfa07000000000e80000000020000200000005710fb5c7e1846af445b5f49e639d480e92c3e55843715d530c1cf38a9aa061c20000000ce4df1b63d0d6f33795854103e4dfc238696582e9677cb0f2dc1160444698a6040000000924be7ed4bd7efd624c60e8eda17b61681094cd6ab2475aeebc98db951608b6a170cf3134676264671f07d2b5dcf2ae22682c5c1080ff96b6500e554b60b97c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{682B2DD1-5CBC-11EF-8BF0-428107983482} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430076850" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0092e54bc9f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e02963eda549b28c04f8375249ecbbd8d24caa4c2b182275a9ee876c3ab7a39e000000000e8000000002000020000000a1bf78cf5110692edb8480d543bdf814c66e9bc9ca1c2b43a0d228504885cf8190000000991f72dfeb25d4984c2c906b696222c894f060a9d55b79c9dbc48e415a8eaf275170ac5752a88f0d20109a80c30505672c8f3dd216916039a0aeede611487a398f5ee9bb42d4bf7f7bd0ac0d87678d9b4c99dc9cc303dcd61720f6fca6597ec7373cfed3cc02076cbaadba7c69d216a38277dfbf4de46121da1b2cdc23a9f36d0788307c44f6af36aefeb2030c658817400000000e4c6c54e95510178e74698ca6d8b4b126d0ec69a1c52deb565fd54b31c6c9cc8e5ef20ccee399b3d110049e4a6ee1b7849ee0bb9a16ddbc5fe97a50fe3038a7 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1864 iexplore.exe 1864 iexplore.exe 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE 2940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2940 1864 iexplore.exe 30 PID 1864 wrote to memory of 2940 1864 iexplore.exe 30 PID 1864 wrote to memory of 2940 1864 iexplore.exe 30 PID 1864 wrote to memory of 2940 1864 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a36ccc40055531ff790beddbb229f517_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dba160c0204b00be3fc28f39858dc0c5
SHA1c4a49cc0f168175a62db8584c3b32eb0d9954cbd
SHA256bbd06e440e6511ef02911c2ca2bd66c90a49d69f9187268f7ef0d1d9c8c080b9
SHA51274e19b592c474cef9da7f7d6a02f9d2d2ac229e8f6dd92cd985e20a38524c65b6557455de0fcb8fff121a557b99ff9a87d35b0c87337479bb5e256831805c587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8eb319f0b1c0832c3e465fe849e026d
SHA1c06f6beeb7d84e9529d20a2be29e09d5ed690bc3
SHA25655471ce251740fb90688ef966aeea43b9a0461b6111582ac77ebf0c1eb09b564
SHA5127157215ed10b9d4415efe7006dc17fa32f1f25e1637139d61e26930abce3d4da7a040132f3474ef70a44043f357af6e56c7f74c3df907f3fba212cbc4e8da48b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5093f07c7c85f9ad6dcc47957362363bb
SHA1a4028d6da2ac393d9f800b802afffd39d12f3c0c
SHA256c70b33903dc3890a1fb36b9bf61f93ce39b423b8c8b20d635c464e1e68c409b3
SHA5128484aeacef9c85cd07d0919f34a6b10dd0ce7c1263b7a46b5cd4850b681ea1fe0d53f50c9cc2f4d924fc8ebf776c772aa8a0968a70deef583a06b6100be7b4e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578f9bc79a9aef83ac1b541fdea0d248d
SHA184f79b0fe75942b100f70d6180a37338677e0397
SHA256070e89d1a1a7fe8898465800c1597c143960e5c1aa433df25fed1f941e13ea01
SHA5121ecb9459a8df3c939e341a1749e45492422539354bf85591647b07448ce5e19564ff649946357e5c573c79ea116c805e89c794d21875d06b3a18d26c2e787105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6bea4c46bc4959248929c41086f56a7
SHA173918fbadfe8f424e842baa1301644c2d3c4d6d2
SHA2563aa423c693322426963b7c92c7b6c8ff7bc611622bfbca0e8656ddee0ad3a140
SHA5123ead5c20e8810582a3959eec30bc8f762d90d48957499bc3602b4aba24aab574a4a52e893f533d8633d9333059d5f2c8512eddcc1d660ce7578e3a18cd4aa3bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585638209a0b5c51ee4b20a46f6c2b537
SHA144edc320548ef4e84601df49ade4aeb942a75def
SHA256984d6c6e6c28c2aa7f01397e0b8f5e302e1904c21d897e85c501e602138225a5
SHA5128bb7efe40affc7d39307b48c365f1346bee8a9be0c6da71f9dbd58a64915a60684f665c6336d041f82cf3cc1986151d71fd8d19d3ad83a40f998ff9484c92c59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508eb23130f71812d8acd744710f69552
SHA1436976f87b19619cdf92446b0ff58eaecc46c300
SHA256a699888a8dd1c981bdb187cfd65246a3fdc0f6214dc25700bfd103a17a6f5d5a
SHA512f1624198548241e2f4926fd740959bab36fccd7e2103c14ea31a8c71e702b67c914ba9f544385b08d4b83022fd8e306938b873fcf63a3b04b22ea3de6ab48942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51621b94af25ee2901fc8045fad9a2507
SHA18db2d589f33edfaead78a9ce84a99a31e66ee3f2
SHA256d5eed950d005c3a2965046ff3cfef75e645caaaad9be46498ca6ef9bd23b89c3
SHA5128a128246495961d6cc27254e8eba9179665e2878963fe8bde311bf03b40a8993f324ba7a38220d5be1189fcff0fd773eb29b670e060cb91b8b17672dc6db2ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a4a757aa9faf5d032d6f137c29658ee
SHA1ea77cc6683cdd19b680c2b5225637637b0aa4f40
SHA256ee32cac4fbf7a0c1cd317dcf8620ac4823a200793acc014fe3ec5fc57993bdd8
SHA5128bb13a2177941dc76451de7f2b96b03ae803c3880e8076ca41cf87003cedeacc8b8cc83a6c7761978c0408e50426aa308883e4d0edfe02d2ac9bfb6dc9877f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579799d14cc1ff250322e1704d7c25052
SHA1edb03f8b2de0967ea648ed95e8451179417a76ab
SHA25651c2a9746aad595651e3bafd2cf416f31065a49b6e10afe104d972857ac88942
SHA5120a08ccc4a1e34f614c7003fc1594aff1b42f1085ea85fcf2c13fc92455e340645c43258bea4ae11cf3ebf6e452bc86df35a75eddec3c6011f867747cdbfcf93c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a41610cf46d384536e39af845c7dd124
SHA1b5ddfa4fb229fb2e0a2cb9408c25f21af843eadf
SHA25642d3d0056f67510719029c2376a9b851b5fd09d87e00d109e754ad898e0bf972
SHA512b295e3b55ca8a8129e8a1c1907005193bd201794c546cd6502cf1c0a8bdf2c41429f135e5ea4bdce9b5b1272e7993702f84dbccb3c2de7600cf4711fbfffa4c9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b