Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/08/2024, 03:16
Static task
static1
Behavioral task
behavioral1
Sample
a95e521e78c075c892b9a319745dc224_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a95e521e78c075c892b9a319745dc224_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
a95e521e78c075c892b9a319745dc224_JaffaCakes118.html
-
Size
10KB
-
MD5
a95e521e78c075c892b9a319745dc224
-
SHA1
18fa2b326085c450a1def10429f004caa1d8d09f
-
SHA256
11006494cf6513f2ebf39e24c5be22b0dd3b538c2084a906c525c32cc1180b66
-
SHA512
b6de52407ff6f8b87fd5f944d7992ab6ef100fb49c343a77e2a89b9caf40f57b450e678200708555949b018a9a756ada75c53267e73250c4765ba0cacf3bf245
-
SSDEEP
96:1A2lsvYb5cbFmKxaZqYlaoKBu7PW/1bFrjhOAKAbyVjhLA3t+b+v2Ge1:S1Qbm5pxatla/o7PW/hC
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000097069e4426d5996a3154d2c852c7693797718af9751aaa7cc69d16cf6dace940000000000e8000000002000020000000cfc1b4f6a9e21a53314f4afff61a01b65895eaf6ebbe6f3a9598dc713897cedc2000000012739d6b9069a41e5f5e390a96eecb280d114f17df7cc262a594776950cbf1914000000087226d09c63fa0233e9a2524f5d4a709a0850434fa2f06228a25f21500a6664dc342d86d5f19827217df4c171cece788ff551e94b02f763978b45a9dc548a369 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430199271" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7584E9D1-5DD9-11EF-A207-6A2ECC9B5790} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b049114ae6f1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000046badec786905492ce28c0596ea09700b6f0d8c9df2b86c02148ead14177f659000000000e8000000002000020000000995ce150fefb9746ffd24b746e9605bd1bf32ad43eeedc29a1e500b3e6e5dec1900000001518e0186af5887dc887acf3e644a838a7506acb61d671fc7dc40362e6df58b8130cbdb0c3e47832aaba64a9cb1baacf5def657434ad60d9e0be602a2e135ce46264edf675d0749d068ecc69ec4f45946a0c97ca8dfbcd263d50a941099b58682e94c211d76fc6a32dd423608dd7631e613286ae82f73b8594b313ffa6eb9fdf5e2285cc0d7945dcfe85d08e9a88a71640000000d27a345cf49e95e2793adf63cfaf84ea78b1f20785d5d66479b8d1481cbe5ad7f771a48a6ea7fcd6b494c3dcd743b165e603f0d26604ebcc2b8281242ef0dfb8 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2432 2384 iexplore.exe 30 PID 2384 wrote to memory of 2432 2384 iexplore.exe 30 PID 2384 wrote to memory of 2432 2384 iexplore.exe 30 PID 2384 wrote to memory of 2432 2384 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a95e521e78c075c892b9a319745dc224_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e94d81f0d9f694baec44e1b28b5ad16
SHA1f9c758667a716aa3f6f49220c71b03d373af9b5f
SHA256be29f5fb3756f2b6991a228beffc40d44b3256832136169c19293e37790a60ed
SHA51277a2bd76473f943a0ab0b9f9122c20a62b9625a907dbf33d052fe78f6dd208a7b92a880ce00f5ada8acb3f727bfa2fabd82cfcc2cc5823bf79081300b67578d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52690b85219c200fef02bc787460ea9f0
SHA1da257eb64de0d7cda3a51f5b64e0baf52a39b76f
SHA256ef62ebf1f6d0ff93093dea8b83a660f609262b6a58692fcf579fb731a9f6b4f7
SHA51276055d057956bb8cdbc8cb30c2d527d07ee585280d2423cbd4ad34025002695a56760c38edfdd9d4566d6811bdf3de6a07670a6580a04bb6d5baf5f742d44a36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc1bb6643e957f92626d99fa4a0567bc
SHA19e43b7254ce519241f305fc0b043163d0c259b28
SHA2567c2f79a084f65ac4707afae4c6f2cef68584e57ff3c48ce18746e487e2b6644a
SHA512241f05eb939e24ede1fea5a8ff9567dfbf879caf979bd070fe50ab9b6ba8c5d06fe17fc9e53885804201eac0e6f018204882b5a4127a9c4435973c4c0840cf31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e015987cab0cea6836526c461cca87cc
SHA108b8f4e1142a43ddd30d9d3f514c9b1b74df905b
SHA25641c18acfcab83644dc2644aefcc368ae616e33bb338efd0222d22c44d98c9040
SHA51224289e038d7a2682b113e1cc04a2b0de297b9eb8cca096d71e4543025708db868e647cfc4fcc8fdd14650c8a6b792ff2e300aaf3ded4a875b26ba30bbe6547c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598f7fcbbc35e91c574ff269a6539d085
SHA12405d6fc1fc4a04c429ee2a57d3d788f187353d8
SHA25656126c85549413424d5873f7048e8095fe5c4d9bf33cdfca57587f0e24e4df23
SHA512e080f43390cd6d0d63d423dad2fc0377b2fcd8d6f1f477ef603747490bf4ba3068d0c62baa3cd384f3851e3dd09f8f29c1b3156bbe48cb47fca604099b67fc4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8496a8a7d8648fbbeea7f4b2a3d4c50
SHA196e3a118c1d92dc9157f5f8d6f06f961d3ec667e
SHA256f8253a2733d2ee9b8b13a1fa0033965667b2c44e346cc35c864ac94783fb813e
SHA51233f17aac45887578908d6534a1deb78d2fbdd14e8a93b28280eed9a1c8765234ad3c1fe1cf22dc4dd56532e290a3fd5d73a2655b63390194fc48c8a98b74fbe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eee66ef60329ac8e41ed50d41d7c7b4d
SHA1b28f7b2d0d63904c65f5709f22b932b813cce0ca
SHA25697d8dbfa7de0c3350b1dfad3afafdd4e9d46a09167cf6ff604222ba0267d6a80
SHA512897c98c408f96f254073cfbafac951e6149c3373351525a5924e080442557540c4d21315389d3e52ec9dfb80be283db4f0ebe51c0f639e28d3c2159a16fb672c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cc46e5ecc34ff13bd73860bf8095816
SHA16bdb5cf50d7a2911f5f12129e95d8da35e7bc79e
SHA256403b0da234a89fba1bcce63ed14c192a9a29cce8c14c9ab37888eb31812760ff
SHA5129c8eca890325e7f147fd2df2a5b7c995e70f329519a8e452ec9fd4bd20c4c67f1d0e74ce198ba159a4b570556532f5575ca46674e13d2f7f518ab6168b19a2f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5314340212605cef583872c9cab82ad6f
SHA1ed394151c765248f84bdc28efc4ab0ed93974b15
SHA2567f973668936ed448d9900649045a874103aecd8cd39abd24fd162d6fb60abcfe
SHA512f519d16386475bf3a9af97870eec790587d2383c5978c1189a3580f70700a2f80ff48e5a77ba3598dbaead90417647401ffaddbee3eaa51500a8766970fab855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c736c6e83c078f080e1419abda5010b6
SHA1eb923f20006e2079e7b8047347dcf68cdd75353d
SHA256c27d7392c3d3b7b8ca780c7ceb8c20f50d574970a9f31df3f52d73830aa8d567
SHA5126742809135a6d2f201425d2b5319b848e10f5dec4c1da997accb38c24cf4bcd4f9ce1ce87d85cd76336b1103c067c88ab77920decc7d57de09519dbdfa074ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f95862ea51daaa94d8f966418ef0ba89
SHA1924ceab1defcc1f43bdf68acfed9a70d3a24d6dd
SHA25602176e9a3ec9fb89eb85a8102f7341acbdb53ce37de37ec48159fc2aecc02337
SHA512ca4adf92685bd68794d4b3ccab5b3dd1cb11e93710ec4daefafc790bca5bf3767c5a3d10c56598109e20bdd49cd94deafe990e03f727d683bdb45328ba74a21f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51202efad97785e91246959a79eb33cb6
SHA17bc34359c0cdb7c7e18a9bcf385b1b681be24378
SHA256f8c49fcce047c9570bc8987fb0f7680c206e5275c5978c62068183897ab907a1
SHA5125f334ea2a937ada5e1a3b0e1c3a40593412f0c12fba98456ef9c858dfe133aa7b5185cb31c56e713d43cbee47986e91a25eaf5d7edbd01810eed9348aa3eb6ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c95ae815ca29c2d84e7cfae39ef7054f
SHA1a3d608df7458da170f381e554f0662a95e80e506
SHA256d61e23278493ad0725743496866ddb19c2761698d2485c624d84284342c72cc0
SHA512b20d658fe76ff5d12e5c0b3b730dd5a3c988eac00f33de5801302eb16e0d42e91823017cb626f719bd5c0ad51671a96178d0312560de5afcc00302c79dcf426f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54601abbd585b58d306faff14d615d49e
SHA157b500fc1ef539accc45361d9a49a6eb1bdcbf89
SHA2561285010816e0ca05d7632f1ca389b6b9e0c78aef6d96840a5ea2bb8e240e30e2
SHA512162a314fad08c6268ddae08a60400f693a0be719ea40268e56417426611c364b2385f119f531a1bdc81f1d9e9f9997962dc1e628dc0dae4d35820e1ddb41de8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5453e0e45425d1c67d048c6aaebf87f8c
SHA12a302a2da5d8756d0f88d190c0d151712045ddde
SHA256b2309adb3b07eef621a82772fcd7e62dee43214dd8dfbeaa3c45b67ceb90d178
SHA512cd2e1df4fa6595da1075e5c3b3b19dfa731d77a01523f52b39fbe07ab049787dbf9991458bd2f550a4841d08f916e5ee9155c7e288fb520090744473013584b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fff2fec6df2b9062e5faa7d8660b4f01
SHA1c1cb6b71cc315fc6f1be0ff07780aeab0dde4126
SHA256a46a31fc379782898389864543fa713ab86742f90471982aef231995d64979c4
SHA512015de49d00669b8bda423d774d85222d3cf6a7f6cac6d81b1bc609f16bd8c0adc4be6d5623115ce21056000c42ffbafb11aac5e3f6d86a9a09e8b8e194626b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525e2725047f3880a52995c4ecb856523
SHA1a7c657a1b563bca45e2d0a1ee8c16a56ce0b7e74
SHA2568f38ec0200e1a090e1a0f20250ce3d58c6ff06b4c1ec11e7ad7eb5b5672b8604
SHA512c096f9b3085d43c2575958199710a422d80ef4a855838cb5ed74fd343611392daab079e1367eb73135fb8e0b4d43033ba9d3960a195be230bef08437aaed7e6d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b