Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 20:21
Static task
static1
Behavioral task
behavioral1
Sample
bd057210b0f15a4c352504ef5d0fee33_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bd057210b0f15a4c352504ef5d0fee33_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bd057210b0f15a4c352504ef5d0fee33_JaffaCakes118.html
-
Size
57KB
-
MD5
bd057210b0f15a4c352504ef5d0fee33
-
SHA1
460546ad5962ffa21f2ef46ff1be03f254644d12
-
SHA256
59995117b91074079d43ca2921f96cefeb9c264ebaff7f47ba2b11eebd793e1c
-
SHA512
ef0d1a3f9258cbcc9f1374b68cb6b436d05399563b7d77b5b60f7bffdb414cdb9489e85589d782297de22481f96ee9cb980549ffa0a758e6549510f850ca101c
-
SSDEEP
1536:ijEQvK8OPHdsAIo2vgyHJv0owbd6zKD6CDK2RVroz0wpDK2RVy:ijnOPHdsG2vgyHJutDK2RVroz0wpDK2m
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0dd00319af5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a437f90de754c98f16e70abb67580237cd767c978b9a75e8733b10feedd2950a000000000e800000000200002000000055c24c5514855a8804d895e7bec7c56167f5f6e651e73b4feed39b471126022d200000000e0b6a6413623af5c2c2911c032e867a95f83778e421d4f9e0e177fc5c4570c44000000075e7896b0ee881fd8db737d88eaa99cc3c0ba3551f99339b60ec4dbe547d3e78e384f47fc451676db236cc79fa9672d6bb3f50081d4b4c75b2dfa2c2097bd94e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000480eaaa8c0aec20f8d9df9f8e587d3640faea8f50a3f94a8eba76bb8d29aadbe000000000e8000000002000020000000866175ee3583bdcd55490f8bf595740a73af845b0d1f2481126365ee8b4f0b65900000005cab89441c95d7cffa80205a563213adde29dcc967d5eb8aaae0cc80b8812fbb2598228d19160284952c78d984c80a4c51e165f0093dddc5d46958e8bfb67bee1408b83dda24720333bd4c357b18f4996e43debd86a674c86bfd07e3abcbba69f1e644439a6ada75d1686a006d731e0a87dded4d40644ef59ad80722f771f3ce59a302637b5299582ed6edd52a10d808400000007b082d9e2ebe796c6f65c0ea5600ffbc8c4ccaff9ef9167e6079f45b31321241b9b5e225f59b594cf4a87695f4d511a1b13750bcf6f0dd451bebdcdd05715170 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430606360" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41F41161-618D-11EF-A251-667598992E52} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1512 iexplore.exe 1512 iexplore.exe 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1512 wrote to memory of 1944 1512 iexplore.exe 30 PID 1512 wrote to memory of 1944 1512 iexplore.exe 30 PID 1512 wrote to memory of 1944 1512 iexplore.exe 30 PID 1512 wrote to memory of 1944 1512 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd057210b0f15a4c352504ef5d0fee33_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c40dcfac5ff12541d1cad491805ae76b
SHA1eab14e0c8e863628cd8c59f7a46ac5ff9686897c
SHA256d2c1382de02ed02cf9ae7151ed35a468345c4ef0c0af0b895b798ed8652e4309
SHA5122fba7887048c950e0960e1b2c9df88f61059b1ed91e26888bb20decaffa69e8e7ec9af10f8709221095b8f104988509c8cf86b88e4c49cdb866fc786f748ba05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a55abd17cd89794f0542f421ccff453
SHA11bfb2fd797f9e258ad2602c927c87d5e12d10adc
SHA256310c986a30e00c184a99c712e7faf78c78e9cb979c8e8c50103601c42eff17ec
SHA512d40c43f00ee13b8f0a5a33904e2389fbfe775881053e00dedc84a032ff3ce8e772473f660790d257011ca98c66907fe75a99598e962eea9940ae525d3fbe137e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ca14216e9d32ddd77400642fd5e6d6b
SHA1aec0e8725591a1ba8b122e9b18bb024f4f48a6eb
SHA2563d2701c77e958d3bf4ef191e7a7e8eeaed3105d9e0fe562d89090669c1b6ae3f
SHA5126f657d7d01a8f92633248653a5704c75f0c646a0b5b3ffa75b3aba0aec587046a4aca60842f228f7dae1ab990ea5894c264334955f252aae7e52a3990a393762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8ac3ea6171dc586574d10855dedd3b2
SHA1bc8d4cbe17fd15301f64f029aec67869218619e8
SHA25601a0294a8e3fbd10e454aba6be39bb5eb4501ca650b795cdea08d6a768fd672e
SHA51271422ee6199f712db13e310761b9e2a649ca56c80a8850210d70bc0c7e33c929b08d53708f017793a58983b0cab00504fc7193f71ca7a7d68e8964dc9749a6e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438d398a28e3c7029b65daf9dc84e37e
SHA14cbbed5d2027abee81a61b853284dd8c93886ed3
SHA256352425e04e0084bf60f3c98f1270ff473882d23fe3119c6dbd4a58540e520662
SHA512d41ded211a8c1d02f89db243c8e86c42d60ad01c60e068cd95073f0ef2cd2260f3c7583d07dfda467572558980b785cc002403d8a491b751061d9dc347f2e59e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574374103455800e589fb6a7ce70cd94f
SHA156dc8842047ee059ab0b70cf50621a07f1da3722
SHA256e77d6ac699f96eaa1c91ec897c1d8258da9e851535f6d17ce11553f24aa57ee7
SHA512892008bbe70565b7d1db5c54fd0629ebb57954866b91c9448b4c5e23b41dfeea6195d63b45dc5ef3fbfd48b4318f0ac4d6f7614a962d8e69d576855fecb00ed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501004a8f2173d81ce2789c09b1cfa268
SHA106cca1bcb9e6524433686b1651be687c65dc9cdf
SHA2561f6b94cd4e40c22a1c29579aa7d8440bad5f1d3b7a7b4dbd63d2547a5c5be5c8
SHA51228f35c65ec08b67a84d03a0e08f7cd0f2cdfc9974b5580d67a78d4e798fb84d278f5782988a6c4f1f3aabf515bf614aa7a1c920b358f67df51bad535ea0df481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccb6caaadf933149562482205e56e432
SHA1ae514dcf45cd8dde0a7d0aafa80ec2c86792aa52
SHA256bc4cfa2df0391261578048b683eb8ce5049447acd839276073a7d6fc50abe7b6
SHA512a8a45219a35395bd205201f25d04695048ab05faf9a27d67e0c4b17f89e07e0f2b056f946c641f947d08313303706d414749fdb053c75d030a0d1a518cc306e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5237e221d045c697134b97235a2b5b5f6
SHA1b6081cd1e8d4d770f13b350ccebb2e958eab4602
SHA256cce6150a813101bab0a749356ea1d0cfe1c4f298099df2dfcdaaf16917d83d91
SHA5126b083f2d8a56196a28fa424bc16fc766b2eb38377d9d89bb2a1b7dbdbaa1e5e452207cddf63e13c57a587229d20f9618d318b17893a9dbe943c8c44bb32deccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d7e96a79b7ef109926759b799cde586
SHA109b44be4fbc368ffab4357bf8b3b3e4d8ad2d734
SHA256a7b122e2ebe8b7bd59ae82ca2a8031f78e0461b474bf907538f805783ef80a85
SHA512537be6cc4699784649bc0c79ff2987d5adf1b3bcc85fcb2b3cf4de35304b4dab0a96781a82341219b35167475cadaa71a994521c6fd7eaaf7f0f7d5ed94181fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503256fe6d9e415cd3e1a56aa19fa0efc
SHA101dffdfd7729c863156ddfe0b93339082c2a9896
SHA2561ae42ac19cf42c7f0b08e74bbbb06e0cd6458cbbb557a605e7c9c2334a35eeda
SHA5125755e481c4d61982829cfb168105170ea9d53bced776264e5b09de9c51ed06dca4078055909a7fd3b4ce007f65b46466a36dfdab57d851b3b5fec15724c745a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3cc6fa8189d3bd6a573485daa92dc44
SHA169331d3cdead70e073131a9e2ac6c049d7b97a02
SHA2564debb0fbeb702be02ebcd2843549276c9f14246c0a111a998bebb2c8ed0a083c
SHA512af6bc19b76ee225ed03baa7bd8557a1d0a5a153c32932b9cf457d807047d73b1d626bf96816e700471dba70ca732790911eef035617f640a0e8fba3b3f36ea96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9314179e7a2c259243b83eeaec8eddc
SHA1a97e5fcb37df185e3d917560e44aab9b122ff37c
SHA256f0ee7dd2d529dbe7cedab6d2443b243d361080ac27315a32d57b3094eba9adcb
SHA5123a69669e80831a4df83176c8e14b0cdf2644e189a2be1d9ab10c0394917aed04c8e56e6747511835de1dd50b923dd4ff9d74d61fe61f4949ebb1eeaf1a432048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD588ce5ef0d5c3873ca66a1863220cb034
SHA15c7bd39f8f780a5288138013866e839d9fbce660
SHA256c3d2361d446c759a8365d0b5183e23e3b5a7b6d16f805e5a1b90350b8efededf
SHA512a892b0a9881fc66eca3befdb87bc8e79a5c6e28f24a422763199f4884d1af2694be80b20ea854506000eff45470cb4468069e537e1e9fc4650f8511857f7dbb6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\f[1].txt
Filesize39KB
MD535e751e9ad4488fdb799ff2ee5c05093
SHA1bb6660f96662615a468de0e613e2ce703730877e
SHA256120541cf1ce005e98991acf361a6f8d344952c46ac18aeb2edba61f3dc3cfe74
SHA512e1cf23aa3fa90aa6555b3176f262aa79fdd2a8b9119f579d45da012f61a9f32b5993c1fbefb715bdcbe3ec8563d93c239fd623b58a46070dc4e90937fcb31914
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b