Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
b5cd877897373205a805b437636cca1c_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b5cd877897373205a805b437636cca1c_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b5cd877897373205a805b437636cca1c_JaffaCakes118.html
-
Size
4KB
-
MD5
b5cd877897373205a805b437636cca1c
-
SHA1
a313351e703aa9d3bece39a6e119143eec7d8dfb
-
SHA256
7ce2447d93a9bab1ad42ec400d749762f9082b9bf2956c10429cd477e4161fe9
-
SHA512
c9ed28e4b0e24490e2016a6966c59870ad49b169e08c8a82a3ffc1187484e3d00e85e3e89ce18fbc8a21fba09c359fc05b02339bc6546b763ebadbf35c2aee5a
-
SSDEEP
96:LF5MPyZPx3/V5PirwTS85ArUes86zM5YUeYBk5tN62qWivF7cVC3xwJSj+P0ZkvV:5myhxPVBirwTS85ArUes86g6EOWxwJqy
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA7F3691-6024-11EF-B585-FA51B03C324C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430451555" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000006a1a95ef0467c2a2a91b1644169762ff5a4be98acee0545faaa8463cbcc3aa2c000000000e80000000020000200000002e59fee4a819e3b15f3c70aee1ee87fd69ae70f7683b3b821717a762602d7536200000002d1fd5eb59d30ef75d485e94aced3b991c3e3a0ea36cb0f10f9175dbf1c5906a400000000de4385cb52df11dc7d71fdfef2119d9a6b48cc51352043978a29b673657057c6ce1e56b526333226896dfa93ab69bf705c43e9468fef7e2d568c040ced58987 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403874ca31f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004401e54e2e5b608652270ae5d1690bc7902808be059892c9224520b99881a4c0000000000e80000000020000200000008f4fbe382706e9e4128b9eb59bba7c6f9143837fd8033d0aec135b8ef81948e39000000029c9e53d296e3afcdeb66703b1f00474dad379ea7163b5c2c3a9b309afbdd302dd836ecdf21fd9266629e11bc21c138af96f1448c6c45575f4125c1d5c1629dc45a4eb5a45e521513a170427e0ee6a4ecdc2b8b6e227d6060248155b458c865073ae5d5c883b2901029c016317eb7a985eaccd712d125511f5b0f0f2e2b4be7389cf910936d3944fc56169709e64bc96400000007438a1f050fb34345a8b1969e118caa75f90d16fc39c565c50ea3ada9c66223892a35cdfc28a3e3b871066404c7465c461de87ba9fdc1301614b10b65ab4a9f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30 PID 1460 wrote to memory of 2216 1460 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5cd877897373205a805b437636cca1c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dbff7510f2a1608b3c36a6b17231199
SHA1da9025a5270f2938159c7f49bf171193656d23f4
SHA256a56924b52765a56f3fa929d7f46d9022772ad8f02ab9374d94228a3acf788fd9
SHA51284fb9124d0623e9381079986d08d6e32c9e66f9b82599d5d18c1ff3c56df43aa5bce4556b35fb3442211dd7d11ea6ad39f10468276a466ce39f242c2aeb0d818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdb0bf39ff81166badbc2da12af61189
SHA196b1859070742d8fca49e1fb0d17a1dbd300bcf6
SHA256c095d38f5efc04e7bae28ba17765f260a9fe627426c412c6cd510e4f067a8b74
SHA512d313573986118656a88769b43c6b5fa6479ae1e75d312c8c1f084ed9abf54467b215c323d96e85baad3a4ccb27230ae0327dcb4ad393216f7a21c8bd47998dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53518042e8bb8b61eb1db80668383e9e9
SHA13fdda8445091aaf0afdc6868c8cf1222e715fadc
SHA25664d8a36906fb4593392033386252a143789f9e2bfa553d59406c4b6e5a98059d
SHA51246ab179618bdf93eb4aa6692c9f8548d87f09e4935705ed579ceb0beded893bf8e67417e1b72d01d1c82a40d50f9f46271c90c74d07f76f6ceb6070b0b7e3a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543a403a3f0119cbd74f0792fbce991e5
SHA1495d165fdbc05f0a4a89170d82d0688a54ac0cfe
SHA256821abc781fd8ad4acbcc31a80b7e3a1b4a27346e5c28ddfcbeeb2b77eb602a28
SHA512bef1b1fdc84e3877619c9aa8a5524e65d507e646fc26e586efcdfcc83291da6c6d682f1b61efe101c04e7051e491fc0ee02b460a6ab6e6e4b8b18d02b920b389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd110c9d54ce62fbd0569368420f0e5c
SHA13ca76dfb42dac51d04ace5722265740981c9e45b
SHA256af16291b22e64bad7753639a1c467be846c071ed08d5559860201d49e62a4e70
SHA51254f64d4de3947ab53ac665e09b4491a15e504ca0d9e2850867577eea71c1aa21008d432c6c8b7150a12d5240bf64d5a6ad0d65e15a1fefcf6d150d8d872ed01e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50abc3cffcaf0019c5eaa0cfa13a681d6
SHA13a947561535bf681434e472f0523c4cd2a6eebf2
SHA256b84c5771099866402f8d9545c27f5ae678ae19f6794aaa0d97b263903a22ab64
SHA5122221513d296bf69c33b304e31bac5d15bf2f02018ef158252a356f6378462a65ea12ccd104050c40c5cef654e04c8e9f1412821154054e212b9dc5c6b2fba12e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5665976201dc80107ad5e4f2db3f6e34c
SHA13f51b05e345f550d704d9d7ce33e49dc4554afb1
SHA256e7ad7b3a9fc4ba5688fab200f82594f6bb93ca0d2a2f1d38cf097750fc9c4854
SHA5123cc4382bfc34fb7767a9370c40f4f09039f9916ad78e4510c9611cbedb6850d65fb32b2c2d70b32258ff7202f373100deffff303cc7687971451f29b07c3a102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5214a14ba0c898882dad8191ef136f25f
SHA1cef84f6a84fa75112c93aaee6cd2fb615ca59ada
SHA256a964fc81c64029a404839417a7b56abe3a64c2a7b01eb7bde46d922bee5d1975
SHA5125ead4bda940aec814a2438d8bf801bc61d628eac5a19b4cd632b396977c00497ef46e40c175fbee46b7b50340bf67ae0d2977494532ccc6343d7d256c6544cc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd6dc14b17eb11fb0d07c255124f0c0b
SHA16eeb39739b91de576a4c817969e3ce443bdb262f
SHA25696addd372068eaf0b92e3b5615a3c627bb3b1b701ecbd6e01af33ba7ffa8fed1
SHA51284acba25439d2ec019fab89d5894697f051457d6cbb6ee32073b577f37407ed8ad6ada1554034b7c0690600c33b945ca993c46a2784ce14158f51acda460e6fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e41784cf2f9be10dc4d18c59b3208224
SHA1b107a9b3b74cf43c73d38e8f256049b906ec7ab3
SHA256b362b3608c1d9fc96fbdef8912e6a3a5557fcca51f28618ffa687520039d7a42
SHA51230d5fe9a474fe961132ef020c44063e4cb9b4cd70e75ec46c5886e4dfa33612e52dbcaee0fee3f426da4cbcf0b8db60f87ce3baf08a121c5f738a11534344650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5412e3d191a9d1bc97b224df03e40f24f
SHA1529c837deaf2bc0972dc80f1d6a339f9c76462cc
SHA256c07e591db3ae874ab099f2a0072468b15655fb435e96ea0b870039b7bafb39b3
SHA512a5a5e7cb3056b2949cfb20e8c756d47b66664426f055eb535d7417b030c14a3158eb3c670ae6da1149b7a8b6e97c551acca28186ed32e2880f81ca237773d525
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc82fe1c557935e013d2e0e76b68abdd
SHA1f0c74674bd1dbbf713bccb1a204c529f2b6e6f0a
SHA256ffb5d04bf2f10727c7727f142c59591b77ed9fd2f5a1804b16926496fd322276
SHA512f9b911fb8bade40e9a3e2884baccb393cb29fb0bb982f8b2827e8d63450c80b42bfdd0170ace08f0cb8afe06abe123c3f28a5a3aa70cbd84ccaaaff0b89cd3b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1a7b71bf017ecfbb1ca586552187a90
SHA1ea290cc32fbb40b1e6131c42c46f1bd1a38aeb06
SHA256b31c5bf2e1c0a00a5f8185516f64d0d04bffabb8ccd6563e0d9403330a9a5e8f
SHA5129d3c15c846d554bb831809aabb5ed689140019e22f770c420b8628ec4a7bc2b7619e3789e98c842abe6f8947d9627d8adc51cd2b480818733ecaab11752c3c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f255c467a12a45e035f609530e9c662
SHA1ae21cb25649fdac05e4da24259ffafe0beb37a7b
SHA256dc73c0102b760741aa30595acfb9d944f70388f315d5ac66307481f67db42a4e
SHA512a59dbc95321540b956f1af06a0651e9fd896d8875f223104c7da50b0d75e754c18ca7d2e38f758fd72a730718cf4493caf94cd354ae1215a4f9951cd35e909dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b96f8ea5da474a710781959491053838
SHA1a42882d3de6157bf3da413d917779d5afc3fd864
SHA256cdbb8282310779a242ec52855138c295651495c35ced30366007d49f21e9a191
SHA512867ec615b8b299690c7a547c4e651c33be1cabb6ad5153224062d05316f9189d9cd2131a5e064a04c65cb817629caac584e52dfef47ff0f0d630e1c25089d518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d7b6b28d4901050927d0f3b09ed73dd
SHA1d5f7a22750a5b724f674c8fa40e5a1fbc6e7f8c8
SHA2560ea1b15e4c7e0d9facaeced17d6e5bd18361eda67e3ecc4e01e39631a08246bb
SHA5121414d913a231138c7822093a7f618d8abe87d679dd037d89ea4330589bc265fe516dada42add43f3eae5fde1bc5f0fa8fc02ad982a965b67949bfc04e7878f3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b753301cc38c4c6fc3cd063d663b4dce
SHA1b4b079898d64db6490b4d5e569eba3cd79e4717c
SHA256208d44f558e54b196a9f833ed82f6ebd892d36a58fded0af530192927d5a451e
SHA512f7e681b05ef9e19e17074bd577cbd2c65a0151c52e54bcf081547329d98766cc4f3efedafe255c98ed6c613feb194e9767d2bdedf78a2acad4fa68b2574e1bd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e19e94d148a9067db3c44b4b3332e749
SHA196072e355db167e8ea235c982b3a50246274d474
SHA256e03ad8e35f7fe04fb2ad803ae52c7e2542d1e6ec37b548f674d699b4ce32ebe3
SHA512a281488b418b138d4fc2ce6a7d11bdff01679d0b34169ae0329c162d07ea1c1eef6ec223532ded9a1c02076905502e62ae4421d5f5f140747e511f700ff833dc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b