Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
b9f4b2888f8fe73ffd84720aedc8d3e9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b9f4b2888f8fe73ffd84720aedc8d3e9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b9f4b2888f8fe73ffd84720aedc8d3e9_JaffaCakes118.html
-
Size
11KB
-
MD5
b9f4b2888f8fe73ffd84720aedc8d3e9
-
SHA1
4ebcac4d337e3b133811fb28ecb1ee9fb3940872
-
SHA256
5bce23ffebe4792ba8243c47ae4d4403ecc57f657cfbf744d06508ff38b63fd6
-
SHA512
075b3bd60be3e77d23b74afb04b4124bc07600a9b0915d4931f52ba2cfe6306760dd878d99020cb8b3f4bcb48eda33850db286cc8e4d5e479eacf5fb48468294
-
SSDEEP
192:2ValIsr0r57M4hxasT8Ib/w1wvqa1sLOXuBuLbdU8d:salIcIQ4hxaGb/ggsLOXguLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000003562761df008f23948b1a71a085caf90bc42af2bfc7aad722e8353c0cebf3f9000000000e80000000020000200000005e4953cac46971f1dd896ef34cbd44467ef07e7011fa2eaad0513319a54b95f22000000013814fa60ed0f4616a726cce65ca5bef3906af89f4c577a4139dd1aafb92377340000000cd55d63796944adb00aa2e17558e70ef06544bf07fd500a5b4df8909329cfaeff247e1413610c0e9e938e6c88b6ff83d974914ccaa89357fb3d5b6764dc29897 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430540827" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4C14B21-60F4-11EF-A1BB-725FF0DF1EEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b051709c01f5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a99fb34460b1354c9ab59f7c07b658f5ee054f333bb0a081eaeb61317d4ccc27000000000e8000000002000020000000a568f36d1bac9881e760b36c85cee99156519c7c5d01cceb6ed0a7b8f4f20be6900000007592a3fca6320de4fddb4d363530d810c40fd84ea718cdbd5853eede492a682324896c5273d724e25fd9348b4009e0540441d8c206b66f1998f07944ce51bab4952d37b6acd912822018b1d0ece6044538b1ea9aeb59e46a3cfd3707a7ae24275bd4e6d5e8152311856f83702356a2f3cdf5efeaae60b387dfa5c2e42c8293cb597734635ff1cf41e20f0f96a068f03d40000000fe5732bad79ed70b56c613e7c1c75b00de03fb08adef9ab336bbcb1d1e57cec4f12e0e6a58ef58d15a1168556abc3e4f6e136bf6300a1072fc02316ca6c7a0c9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2684 2112 iexplore.exe 30 PID 2112 wrote to memory of 2684 2112 iexplore.exe 30 PID 2112 wrote to memory of 2684 2112 iexplore.exe 30 PID 2112 wrote to memory of 2684 2112 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9f4b2888f8fe73ffd84720aedc8d3e9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556fa7397ddb852dbb87a50810d523b4c
SHA13d094db91fc7b15949ea86ccd51cfcffd5227fd0
SHA256ba92cf8bc554782bb226f070ee24860a0c2c8fdc8190787079dc179649fd0bf7
SHA512a255757f0e1b610cf33e2f1e998208707ea6a87dad01567d6348a5713edf7615d40a1d9865a72f0313f93603238db059a4c0491c73c6b5068f75e7c2cf554ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553d8cbc167acb50ea0858b5aca1af478
SHA1f1cb7818e4517f68bc2775964b7ba1963dded615
SHA2565ab22337b1fdac3c63e78bcfa134ba69f24de5e44089db30213a28aa75b71f7f
SHA512aca9f348e9fd5e29bf99216bae0d7d29fd5dfef507f86bba0c22b2f45f76d04e5c3bf2a883f67f2c2f6d68c6efe05990dd407235dd18760d43fcdf2f29dbf47f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fee4c609f03cf1a75e0dcd2fa6343603
SHA1a3f6b43c9ef2f5219f92c591a3a03aa6607db2ff
SHA2563157bfff1b300d4e10b1a6c0652055cd76425405f329765b4114ea430e1fe5d4
SHA5127d4b3c9cb5819ac6a99e87bdf51c5f37605cb6498a891bf27448f1a1f332604ff438d0edb36b40e00f157ca4179056485d5d50b844f022b17d405f3e35187e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d56c219874d262f8f6638a90fb853a2a
SHA1e8608cdf153c58a428774e7d5cc3e70912c90dd2
SHA256c68e77527d003b2a7a4cba5e897a6fb5445694e9bed51b336440b3f18fd677f5
SHA5122f6474ced7b0655b37a4fc923a47dc2ccf0a1af8bd9ecfee3c238be1896a755741419557710e173f58db20ddf724f40b7efd2014b50d3b39e4e5e3360bd224d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567bf769cdb457ce2d8013be71b2f6f2e
SHA1abc418a9393cc51f2c8d0248307399870deabc8c
SHA256b655130f65bbd791b5fdd578f74bc49a2d668ff3d8094424c23930ee416e2509
SHA512d9a5628fc8a57396738433fbd9da363aa30f8964ca8aeffc01095bb98a505deb5f8a3c54a93b2a0dcfc61a9fa5e2a3c86d2ed71cdb281d15ae6042739d7aced8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d632c506dc5d7df5595bb645159964c
SHA1c3b64be849316a38a64e904f415bb576a93b0fac
SHA256afee66ed47f3b45868b8e5a18c9ab810635f08d19b2466c0a15a318d42c992df
SHA512bc0d7fbd12a08d14137628fee75f1af7dd86167a77fa1d1e938fd7e237fe465cee2013bfa39b9244d40748b21418f7cf53286a9edc19f2fb71d14e5c148f2079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7b8f93a866a52ac78d838b660b56d6f
SHA1d264c2b06b102749d86b3c6663f0a309747d85fc
SHA256f2947d8ef711884df84b0add3aef5db9cb4f8ec3334d6d6baa1fd0c8e16d9dce
SHA5128e11b37c2380fb5628d9e851786302744774930143a5bb1565ffa4a29f3a5e4a832a0fe67bfe47c1eecafdeff8fd100dfbe6c971f6081b133036a6e0cdf1481d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aa606058e3f8b0157021b1d31cf5931
SHA1edcfe823c94fedc227174598148d5bd8d4e79547
SHA2569089060b13f4a54c6bcc76d2016fca3d029a97c5fdf51ae08de890ae9b382df3
SHA51236c302644a768f70df2701fcfff5dcb37cadd8334d99f907f83e7b97344c5ab6b3971214009cfcbe75a49cec9a8c892552ba18ec7fd27e1657711b6a8ba0d43b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9c057128d6210118d042010981ee6e6
SHA11687e348acf673c119a3b459b1cb14bb9b05db82
SHA256072e666a57b02ba0a0b362995f8ab78c629bf847299c624e61560c7130596a79
SHA512c4d86b1281a52f296bbdb9567f18aa707983197416de4d4104515c71073071a3af1a87f3b0b586d6afb0d433523065545e65bac869deb4150fa9d868eacc3a13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5a79e167a0ff2cf17382286984a0a35
SHA1bdd60c4fa066f1d7e8112448e344d3b88b4f78f5
SHA25679c78a57ef077ce2271cef3a13ce0501d1c23415924e2e4cda48412bf6f6429c
SHA5128cf260da5ed9dd63a14bd86b30094bc36974d79df57853faf6b296a5e1836b5aff474e8baa9e7ef851884116fcaee77239adc97e4c356a07b7084a230e9ab14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c92364dc8743a9d65d580ab8f360729
SHA14d7a014501a403d716d8300895c877f0ba215916
SHA256fd7002b647a2f5a86adb7238b7406b64dacdbdaea4f5751b55d0c9126807e83b
SHA512c56e895e2b5702345c24c3d67bb55eb8f545555e50618ef540e8b79b548ba7b2fbd7d4b9076fb3a796aec64a0705fcde3e181910f10683ae53e8f4d803b25bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a190629fa37b7fa13166b3e0b4959c07
SHA12c55f6b1f2430d41565797bb9586dfbe6bbb5a99
SHA256690844377ca4396a280bf5c92eb9a3babaec1408bdecc9fd1f8c86cd0052720c
SHA512086146faf32017a9fb49c1ad7e0695b6a28a952d97bcbbab2cefba89ed0db14c82e11ecea5487586cfba83de2e85033fe2c074a7db1ceb7a11a88d9be8eca1fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5399622a5377057d920a915a036575ac8
SHA1e7d33b90b73af9fe7b0cb5385642884fdc50df06
SHA2561da36997e00ba9785bac6f8d97d720fd24d8ad8f7b6ed50a6f5d13771d469793
SHA5129f11bf40ae865a6b5acf357b66b8acd11f6cad55198a77614de0a23c7f2587887a159972e3c89fbda01ddccfb8842df70c7f3b270e020c599f5c370e0f58c8b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511100be30a44955b9be177dcb8e7ce2d
SHA1d6b4fd964a6b3bfd5f7449279a25c36a2b6d2c1d
SHA2562df7db7ae72b2b389f1df30f8110f9ab416bd77edba5106f16fddb15f7645b4b
SHA5128d593d375fcef42a857a814b31dcc67f4475b40f89267bc0614577a5d44fa3f4fe9258e0d661768b947f4a125fd2bed2f7725e2971164b4dea4908efee932007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e35d9de2e86e2f6c542d2c22a2f7682
SHA10767710bb8494c060ab5dc9424dabf6934d58bab
SHA2565017b29b3e4f1cac82f6c867f6e78fe9dfd34fd647215c351bb664efe821feb1
SHA512c51f0efd0b8d8987db7203f6a52b7ae91dc87925b9fd91d268f2e4b1d7a526e9fa6a425f683483d954a81a1efc0b7d3fa37e47835bfe0c4a08258dd7cf0fc8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d81e7069d131889076126cb354df8684
SHA139efc269f213b5ffbe3235566d02ea5347e5d992
SHA2562193080a1099727e26ddd54e80302a62442c866cded5d5fce938540f58f042c9
SHA512eee3df11517b825c49ae4d96eb78acfa414a84617751c1098d8a1b642696feefa09c94723e61e7bd7aa87f4161520b5849cd8400fe993009b6a4957c87afe2a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce17e2149fca21cb101ac98e2c889d07
SHA1858253736fca3006e1ac8af1a3c9a0a748df4a7b
SHA256dc454cfc22db8fbfd9ca7582218fbc6247386f9080a5cfbf3a10f61879bddbba
SHA51247143e160f0495849e3240f3c04ac2a38411924051614e65fc997cdb9ae1a538d549a0925fa81d3f8e25608d621a420fc0b721fb8bd3dbfded68921afd092ded
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b