Analysis
-
max time kernel
130s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html
-
Size
23KB
-
MD5
be3c6965dafd7bd06ab39044f6d16353
-
SHA1
510468d51fe2c0efd18a420f46c11bc5b39dcd30
-
SHA256
c60ceaec3b8149dc5a57674e25e02cb6b44f3078b58e100baa776eefebf6e8bf
-
SHA512
154cfd1d2af766704cb07968427e4b7122727848d08bc3decb4c1b035bf39e5f8e0f2be590eabba67edcd4c2af22cdd77459b49be0115591e2b02403ad5038be
-
SSDEEP
192:uWbIb5nGmnQjxn5Q/JnQiecNnjnQOkEntbXnQTbn5nQaCnQtGwMB8qnYnQ7tnuY1:DQ/DmOl
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2175F5E1-61F4-11EF-91EE-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430650530" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE 2528 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30 PID 2552 wrote to memory of 2528 2552 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be3c6965dafd7bd06ab39044f6d16353_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ae5e1066550a71003227f7d125886e7
SHA10d7ead94159ca6029bf7842a137cadbb5e0266b9
SHA256f18e09e8c74e49ad99498df8ef8471f06adaa36def326af50972896af5573755
SHA51218945ae3d8e32e5491a1808aee5467ae7257a582370d148fbc1c4d86038325a9898fc83aadc154ce025aeacf9d4ffd8e553f7f92272dcb5d0846992798b4d90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e90a24bdbff09293c140a8e0e7e1a795
SHA1dbc34265579fa07344e408f40e686e19afbe54c9
SHA256b7affa22e39a60861ff23854aad1c87021c331fcf40bd1e82136ced0d4c46ea2
SHA5124f65392bf72df061f08ce9b6ba6eecc7d5b27dee30200d5c85b892b2bffbac4bb5524d32e21f85a732c3bb35cba55ea1019a63643aad10576d2844dfb8c2ed74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053b9d301ae3d2ee11d48a71ef20b56d
SHA1ad9c6efa86043c4fa967764a0d91d9e4459c30b4
SHA2564b0beef44a73a2e81ef6decaa3062dd5ac6256c92c4e6e13058427abee84bb6b
SHA5124490bb2a9a3e0ddf90b0dfc155f27c484fa22374150ced256b98638060ff9973c8927fa3c524c80d143109badc807c91ec2489311327582ce255062ea53ef047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dda7abc15d856e3093985d81337c8a0
SHA13201f375ff6699155e7bf593a32632bd764e3741
SHA25677d3af106a40c3b251005208d3c838c2d2ca6075e745be1c323998100d905877
SHA512ee2131fc019abedfb2e1d5af8905396934195516c21ea79122bc5cbc03038593151a8d5d2a1c7e7836fbf4d07f2651281400e1f72d67bcf332f94414408fde3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e565ae9d20358ba063348d7be467602
SHA1dfa27e840aee974655cc0ddda69e6e90a9606713
SHA25600d37bbf3bebcf1dc254b1608910dd2b5ca5a497fbc22893a86d69045a03cb2b
SHA51231fcd73b139285014e9c3afe844d63ed2524f8efba916744dd31ac16f68e1907189f61c417b69025ce8e1fcd6bcb33c54535ba846d852f90baefe0e5332759c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f0f98a2deb5d9f15f59541ca099756f
SHA1720d1d76653b9349f00ef4a533b915a12652a0c2
SHA2565d66ac63ac567fb364810e68266c3af0206edce2fd5f1196dfadb202cb632a8c
SHA51298a730eb0dc0a4ba97fcfa671c0e84f214c9232da5a43f6ba12cbc97486b8db2a4491b32315d05b8cca327dcba2b824847cb53f271b4413feaed3422745ebca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f90959128c5b7604faa2997f4de48b3
SHA1d5b2996ed5053b3e621bfa1d794b547708f391d2
SHA25692f3ab1fb293ee4c4426bd680a32fbc783f56f040b8a8d63f5d67b838fa0150d
SHA512ec02d4aee1f6518edbfd0f4b766c513d26db026c8971deaecffccbcae38723823273f53f8a7e59f07cd2d8ac5f2fa2332c777e5b0093647145f7eb1b47c71601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549da91b30f4336c64396b6abccdc41ea
SHA1940a97783946fb54d582e0fa6dbe2d9bcbd53ea8
SHA256d5b3a840b0b3b1b10ce56c392f903e5d4b8d83c1062a29a2bee006fbc6f3b9cf
SHA51230cb43fb8ea52890773234f5a4fb147bac8e604c06d306e0ab1819da5f87c78e651f46851664182ab1ca9d5cae848537c3ad64dfdafc425dc4e6e0a025d4adf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a09a500060649e9ea96502012e796086
SHA18bcea688e851e3264a8b9931e65a1da6ca43dbc4
SHA25615a056d77f090f5fb010363ede5da1b381dbb2698b2d26c92ae184a7435998e8
SHA5127e702013b0e31c9080f7acd5db0a42e2a3f5c7444ac96103687a5ea3d592b205c344f05334ad5ede28c163febff0b698eb3f18cff123c2d5483e204878ec4aa7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b