Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html
-
Size
145KB
-
MD5
b5abb32f07fdd4a495f8ed05850064d2
-
SHA1
49c062fbe5f5eea003652e702538b59ee3846b30
-
SHA256
b31c04b4999aab8f95f03b3edb275e85b6c6fa08a2ced338e508cdf3454942a2
-
SHA512
7a879464bcd379d2bd6267ffb583f8dc2556452d13199a46d60d01cef18afbd22e2e53f112d9de6364b67ff3acffa67b8ea9360648ecffbadb4067b7b46b3d3c
-
SSDEEP
3072:5B3sFiu7pcO80B5wKjgYikmI/nyGFd9BI+qHret0:5B3sFiu7mAS5EFJTqb
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000096fca3cd994ec18ced7b8db458898d91e5f452f5d53128d9cc677c2aa221e511000000000e800000000200002000000008475e99db9ea3a6adae71a29d539eba963a08f476fff01ab57438a42ca452a8900000007e42cb743cf521f2df0b8ea04e48099bc824eaf8cad1a9256a2d08ca154834cf1a269f9c4158d8b9829999a2d9fa682f561762de9d98e183b431f526450b683b7f04897dd2dc2504247531280e5b4d5ef87f456e2656d31541c13323dbe2b4395937f6ee9397eb3e06fd1f75e00d674dcef9a50bfd0d90454a546d3477c0da3b0d42b0390f4c97b28bf238e47a7d46f040000000cfcd96b0334d84e34a518039bc1f9a66eacda010ae7a44a991ca857af9ad0b71dcef7da395f6aa4de6b9ec2e84625420a0b654d9c53498a3441c980e964ee6af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A280B4E1-601E-11EF-AD79-76B5B9884319} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000597200c4a94c14181e5482c9170dcfad7196ce9d1460eeeaad2fdff7404a0fac000000000e8000000002000020000000e5197259bcbc10dadc18800afee70f18f9699a2b7d1e8a3c0cd3766f32dede4d20000000b365c099648eea7bdaf4a19d9a4bcada2937b872711b09e7db4a49727fc84b9b40000000d6f99df55b5534d28606a0fb2edf3e8ab26482e211505f49307c6e9469f1056e81fe262ca723d5db175adb51b7761b8174cb3e1f1e22fdd2d86c7d162e400a9c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4067adbd2bf4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2464 2872 iexplore.exe 31 PID 2872 wrote to memory of 2464 2872 iexplore.exe 31 PID 2872 wrote to memory of 2464 2872 iexplore.exe 31 PID 2872 wrote to memory of 2464 2872 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5abb32f07fdd4a495f8ed05850064d2_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD568a678c0f5e56936dc9b990404a52232
SHA1539920ba3d2663b3a31cd4435d1ab7e218eb1967
SHA256a90543a88c560816f3c2c8f0be954c8bbe3056c68575be3be4337e1626d69349
SHA5127a75376d2c46384f6e11d2914a7dda72fb7f0db78e716f4390376297b2f5a95013d5af8a0eba806cd36464faef11e354f78e775829a98a1ce533a3cc578b9cb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50928b26116092b3fd1c472bbf571a921
SHA174cf9e9bb2049153825eafb8b6e655b7a621f496
SHA256ccc616173b2353b5cd93729fbb495356dca726d29904195645061d4fd6997644
SHA5125cb381bd765879c41bd76d547386f649830980868923cef3d50b85f0185a091e1bca5c53832579438f5ef3970aea0bd62cc1c86b0550f0ee22a2d93c18ea07bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5467f5f12b4559d2b513d8022e72e403f
SHA1849fad6f36d0b47ce6e12bec7cc11fc77a87fe71
SHA25604cce9a6b041387a82820e69a75ec9478f9330a37c742e504b63754427d522f1
SHA512daa5d8046cfd32c39dcbaf71d7cb253ab3be3b3435cb376b2c30ca418c5390e51c490f7ac15bf1f1eb012b6b1a173a463142fdeaea806440902e4b583b86f86a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bcbf434667e85e40eecaab052056ddb5
SHA1b4b9cd627b252c75832adb07eff3ec871ac01e5c
SHA256f9915caeb97e24563e1dae8850d1beef8d7c8ce66ac46e4663adc964953f88a8
SHA512b1f030a15e14c8acfa55b3d989ed0c51edcc8e098759aeea1af475f0b3d2b5d5ae3647d6d50318d455196db288ee535203b262e9a0695d1b6537a92ded266d95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c584e77e0d800c0c575f5c8e7c4c0177
SHA1dc7e998990dd800d8ed7f1db9632fcff62aae510
SHA2567e4faac35ee8bb80bdc0238ed21c5afdb97a5a2fbb1fdc47ba594a25e1a6d45d
SHA5123ea73694505a4edfd5b784815c7defaa31e9ab95500d13e8dd285dda39432a5c595e01b4492f9b1b87ce92ba94e296060700a75a8e13da68368246d1d2be78d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b929a4a54404149a088d6c882c13fb8f
SHA14d02cda0165d3f398106fcdff5c069040cb6709c
SHA256a5219a2f5297097db94e158a0196a781a3780ef7c3485c111754e4a381ece060
SHA5126ced1e2e881c459ef8f7ac341b143f32c346b2c3dbaaa01fd36eeac613b90200c713f5b9e7a9ae8ee9b5c5c816f188ce18ca6990982064db0e61eb37ee2b41f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5b17ead79477c1f3bba534a7f2d906436
SHA1a9deb889efd41ab243bac60b1ec4da8573dbfa16
SHA256361772578bd0c5d275be09419e54b4b79fe17f5ef918464a446ef1f8a89a1851
SHA512136cf5949d4b1c8af511f709bfb712c187163d69c3e3f29c411605e125c676d63f87a94cf3589d0f075822163c393d3fb971c06694dc6c1af421bdc5e2faa712
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\cb=gapi[3].js
Filesize135KB
MD5cb98a2420cd89f7b7b25807f75543061
SHA1b9bc2a7430debbe52bce03aa3c7916bedfd12e44
SHA256bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4
SHA51249ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\f[1].txt
Filesize39KB
MD592e21882f1e031f5a59b2e7f2c258694
SHA1f0a1c6414f246fc046756d713b81cc17c40a9f46
SHA2562f41802727ed5f6dc0be1221c95f82b04203fcadc1bca23dc48e2ca0e359d54e
SHA51247002514ad7739404c4ce8f97a131b739ef07a433df5a60ebc019b6e775dc7702f4034686c0d3efd6e435f27e6664754c324bb96052d96f6ad75e0e4427c618d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b