Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-08-2024 19:08
Static task
static1
Behavioral task
behavioral1
Sample
a3c4815ae83144d8ec0cc541106ce9ec_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a3c4815ae83144d8ec0cc541106ce9ec_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a3c4815ae83144d8ec0cc541106ce9ec_JaffaCakes118.html
-
Size
86KB
-
MD5
a3c4815ae83144d8ec0cc541106ce9ec
-
SHA1
19167b0ee2192beb8195d94acf74fd5633fe2a1d
-
SHA256
31d16b180020e169cf8d3d50ae8717482434961de9395df6a326e5c17a30dc8b
-
SHA512
8a22e646a5dddd7948675f7481c7bf74d8b079abfb69ad92a6a7ed7285c3903ea78c5b4ac07d0da369d608d240eb96933f2b601d83184275e2c9fea427bb8d31
-
SSDEEP
768:IOfiAPMz3kW1T0YRwTIGmuGJUwuif1cyMo5:IOfiAPMz3kWWTIGmuGJU3ifqDo5
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005b47a689f132ffe36b0f55ec6f79df43785d860704578638a2199f0296c94fe1000000000e80000000020000200000007517b3626e99bf31aaf6502e90ae78d05e5938d2c1d46887b5a70b8594945b8990000000befb2586bbd11adc8df9a9441c72fda13ae056289368a0c3571355ebdddfe14a928e69b3cfc22750936a2018ac74320fa5880130dd594f0bc91cef8a41d3ba9ee5d6edf0710942f463c20e149df755617b3f11983a089426862a8f7f0953add1ac75e823230eb521e217d2edc7e2165f03a391c62d698241caad8a3c0f91ea0ebb4bafec0dbf555e8f085a0488180682400000008689f258bc543bd131b104909e91377bdfb2bc45fe280f8d1136f134dda6b31f1d53c40b3e9b3de10496c322f613809c5f1d4f11a71b987e09d308374347210a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000593b4b1fb91a0a2ea9a893e3c05a5a6fa090b25b76b4a791302579eda8b6b5da000000000e8000000002000020000000f6ebc24c66dbead381435931f49b151940859be3502811ee2a1290fe0b2e008e20000000736d1fff62a29417131e5e1e7ad6b97d891cb633dcf9d958089841dff46f2f9a40000000d0742b76456f135c82620b56cfa0f475acea1591e8b84405484372821b76cfd0c8995f2f462f10037f3406abb9a8c5b0a08144498b3040fd37e95859684ec8cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06ce9dfd8f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430083579" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17B23731-5CCC-11EF-946E-F64010A3169C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1720 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1720 iexplore.exe 1720 iexplore.exe 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE 2584 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2584 1720 iexplore.exe 30 PID 1720 wrote to memory of 2584 1720 iexplore.exe 30 PID 1720 wrote to memory of 2584 1720 iexplore.exe 30 PID 1720 wrote to memory of 2584 1720 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3c4815ae83144d8ec0cc541106ce9ec_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586be9477290e3a1bd21df0e99f054850
SHA1d424b3b3cead8bf4e2cdbb5e5b1d92d500d9ceda
SHA25677fd144fa455d0393a830f9342e7e25b857e964da53b2469033d20b1e9883499
SHA512edcfd2965be9a65127ed04d3e8f382135574daa167ec37a6fefbcafa68913261a65830f02f2125ccff08036b0d18599e972c464bd092c234331d83e30179e888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae6076a2e470b7e806821e01d5036525
SHA1cf98bc94ecc35cbd87518c0bfb9970d76ff86c89
SHA256f8f40d89edcc2e013f50b88d19cbf35fea1060b755a228d98514bdeb42eaa379
SHA5121c665a3758066665fec07f0b92204ab921b1d9475fb9d5f8c03c1d37fec3d0dd51de695875b768c7dd11f575f03d2dc643a6369554573fc36d886e809c675ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd5dccdb025c297bec2e258de4813b6c
SHA1b570b1e285c75b1da60d2347bdb51dcd4ac8780e
SHA256891ec8892309809ada7f0e0e30f5459b5cc9c3fa810cfffd7f627804830ca05b
SHA5123719c560674fc7a82e14d531415f8332fa4c5463a8678f6f5512746ae625c85a5f5102a14623bf90e9b904e083322b39fd03123c136ce2351b879aea8004793b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543683aa97310f693c0912930c35b0ddb
SHA1a5c96b986789cdd7e495d680acbb450061f35a8b
SHA256707e5dc0064a7ff623c78e3d371d1436e4eee702cbdee10ad8729d24670113a5
SHA512c759cbbf60b57775489756605bd18e6d49ebd59dedb1f8f63b5f0ca1f085c89534b0195f588f124d939177928a7be4a5e857f01d770967e7a920bcf95a9715b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55333c30a6245fc4e460380efe44ec284
SHA1ba0e2fb8c4c9ae16ec7f1b687e9d486c28e1bae8
SHA256e7551a7703b3e54a8094e9cd54cc93c60828b5bf0c5fecf57973b06a8f04d495
SHA512e22413f1be413f2efc9483d4d57d3baae32514a986ff604297b21d319f5ac5ed5f8ab8f0993ef19eab867c696e72231a3b53f9d11cad99af15d56948cb4cff98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3debcfc3bd9154e9fb5467a39440b23
SHA18e3c778f02a7686c9bf37762dd87cfe65942f0e2
SHA25613f7afe425fbe865d06f88967c978ee71a0c8cc8c2872659fb2d6a3613619628
SHA512af47b2a73fdfcc8c6c43eb12c108e9476d6c44ca704dac491f0e4736bf10b4516526832ce62466d4b208da89aaf261fecb6648869d10bdd7f5c90b48ec7d9f11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d01c1df3aece56a31f0f2b8248b8e51
SHA10bc1c6bfb1f1df823f6816a0c627682be0a2e5b5
SHA25646cbc98f5249e87c83afe8f0a300cb5f3d56835521762aca89d1278cc8b8a724
SHA51216df79f4d01f626dd934b15dd63aa2d40d75764e2038e97a646dc1f77f30f985e4bf3625d324c98592b2a64f12ce02ba3b45d702bdd4407d126312d95baad26b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5822be8dd794dba3c956a619cc481656b
SHA1e7bc11df25ea58e4850ee6eaccebcf0e62c88068
SHA256d491da3a29504d0dd7fcd68e9fb6a443e41e74535110557851573869901dd040
SHA512260800b2311d8061f7778e9bf83bac6ac53ebc3f2b67d6db52381cd47c2c41fd9a920b5c84a6b87b9c1ac3dbb2ae54383d82233950aa68075336a3121d22c2cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD536e04627d6d8cffb2997c020b477f6ff
SHA1bc9cd44975639cde7a0341e1f04fb906f996729f
SHA2567a2cec443bd9d3fdd04c6d711abedfa4558249a771bad57b0d10f9370c040504
SHA5122a75fb7d55e6eb94dc0ba704e5a9e9fa8945c04d72b49292ed37f7f232f8e28cdff9211c6423f73d1cb0f3dd1e9b6bea3929b4f79026e29807c544070e21f698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599669106bf74c084b8331c90732877fc
SHA1ef7173fc46e2fd39f634218ff6ba11a760a7b6f9
SHA256991746e630a2e2a25344f0a64a7e73d537d7d72f4788bb9880f72ee7488227ba
SHA512e5fa77c07222ff2e1a8d3de94e12cc2b815a64bab2c421bcba5193c6e96d5597a603732519cdad7eaf70d96a221ca2ab289c1fe4d410cfc62dbc3db1cf063da0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b87c09df208dcde8872c92d0b91b938
SHA1a7d74945f6ae14e9ea939676bc266a95a4c72d87
SHA2568d9b8d970c90e4b197e89ef5735a0b83a4d358f3e915763d4281b392df29f317
SHA5125f00c547cb096138cdede03c0fe6fcd5ec7a57998b512b62b8e893955f4d983853a7a46dfa61f10badb71dfd4801ceae0617ba0dc67ddb57211d4a75ab9667b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589f165fcc048c2cee74d5c0b628fcbc7
SHA168b70b0eda170bbc342762b5cb7e543870ca0006
SHA2561082f1c0ede1e12f4d130c73ad1f5f32ff1bf079a1f0d69b638e69d37dd7285f
SHA512d272b8f3ed0e5bc33594ea9c9f59caf8ce853d565a7a7f1c43654f4e77c6b38e9d198687cb11219dc74524ed17ab971e7cbcf60b06e5d961be4ce7a85894d53a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3639032dbf59c469789104a5bf89e68
SHA136f96ba122c757f9b9512de14ef7d2067c331b66
SHA256a9d07415974f3912f55f05701264252bac3e21302da042b4aacb61fa56a53cec
SHA51259b38f54b5bc74f9b88914951c7fd3d62c8e3daa7bfc8c58044a6b47a42303a91360537282a68a3dcc1d8eb54d1a2e7c15b68455cd36e6d489ec3ae186bc44f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6f4b41230c682807d47939c2807a4d8
SHA15fdd360cdb6cc7f21a74ed01d0d4dc57fecab7d3
SHA25632a703265d1afa4d99e46ca79c1607db67904aef9868482088f9a179bc009497
SHA512867bc5c2ca7a233893bf61d733172decd21b5b26236cc8e29bab35b81ea3442daf4a57f0d51902aa9a44491b46fbb525bdd67ed26fc233647394898cd235f8e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbcd98d8f740e54b2da04081c80c3de4
SHA1f4fc8c0c79bc2d028f579caeaaee48028b761965
SHA256b82d7eff25b0d4d09d6b73406ae00c0b78ffac17c664eb5730bf079e5d0646bf
SHA51245be9d641bc20419352d4070ad484d843cff79d5e692e99a697ff6dab60f2e803b9ef5503308aa00a2a250af58ce7e8d3fde020c0a01fe52970bc4775708ecaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b41b8c35b04f8e8deb1ae420c7f25603
SHA1d4bbd28f85d8625f2c070879a7b0d56865751c86
SHA256556267c2982e71808cae6121e68ac591070dfa4de004cc1d1f478473d750c963
SHA512559f5243592a5a8d457dcd4567dd19b48e8b471c9a82a963e3e8c9a49cfd1b6695371c9f9f86fbce35cc2f4b575891a6984cc40b38c81887d07a6c2a3fc2cfa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a6b8a036a9c3bcb8f559e87ca43569f
SHA1633d591cf68e8f95baced7b6d643e525617c49e6
SHA2561c46865f6b9447a511aa738ef8e49c426ded1249cad7b6d3ec3469bb2e32a644
SHA51294d32ebdf05a1cc302a064b755c20ca7b3eb49905b4fc2bb95119ad72e0d8b192e5b331347dbf2d71462f3567ef377e4ed6b7c08fdd08ca029038587070634de
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b