Analysis
-
max time kernel
138s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
bebbc98c01189b52f8e29dd8167fc32f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bebbc98c01189b52f8e29dd8167fc32f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bebbc98c01189b52f8e29dd8167fc32f_JaffaCakes118.html
-
Size
1KB
-
MD5
bebbc98c01189b52f8e29dd8167fc32f
-
SHA1
ed546377423535f76c78eb4e257b3f5445464c29
-
SHA256
7d1f28fbdfa2e9fac945e77a238570321537d5af74fe4fe2cbf95cebe734022d
-
SHA512
36e142de9c9e3b1e217d989dd98577b1fa85731f43fcc87171ea419395d72c2a76be38fc70874785affe41880093323cfdf6b2a398f4481e2f66eab2797bdc8e
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{980A8AF1-6220-11EF-BD32-F6C828CC4EA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000aa58cbcf63a936187235c643578eb27752a68511958cf0e064fa87585bfbee11000000000e8000000002000020000000b44a4106461da4cd504e9417920487729a43b6fd86143857c3e29e7c3f211f822000000021865a7de146996809dda9fcfff43de70c1a312880d3ba3a8af1e5ef69a665da40000000d8a90503d6bb1c6ae15e7bd5229a3a73f4e56d25493d8946e6a854df8aeeff8eecf20c77264c381aefb6b35d48c94c6e650e42e6d30f4fabc00eea17e8242a2a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430669631" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ecf83db665dc345c2b1d4ac44c5b9aafdfa54194dde9293b6a9f254baaa8bac1000000000e8000000002000020000000b261f17ffb332d6da68313df5b4a4d901045fd09b6c9270d28411a2d3b249d0b900000004bf3374557aa690acdc9256de98968ffbb437971488a370ccc2be2c00a7304b169aad7bb50af164ff6ccbb34a1bf48edec70457a24d23948ebcada5b2d6e5f556ee0f03a7c934a220d102b49e88b353cc2c1cca7ebc1dcb3ea643bc3a8b7ee5d855b3e5a88973a4add225578db1b8c9a872a7bc0e1d769d6e5ea6202467475d7727e7c78352b1a551f0af8976dc41c6e40000000f2b9970fa791c658f342ce5048fd21cdf90648d8156ac1c3b7e0bc6fe827b9018204352252af67354b3010cae98a572c59147360831ed4e6dc2f213a30f39fc5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10912a702df6da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2092 2336 iexplore.exe 30 PID 2336 wrote to memory of 2092 2336 iexplore.exe 30 PID 2336 wrote to memory of 2092 2336 iexplore.exe 30 PID 2336 wrote to memory of 2092 2336 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bebbc98c01189b52f8e29dd8167fc32f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592eaf899ccaad639475b430d91a7ca8b
SHA1e24630ea56cdbfa1172d8b57bba0235536c18e60
SHA25604b10964738da8d0a7e70816777c40ca28a312c6529ddad1d812ad4c7ed46ea0
SHA512b3fe3e74e1f3fe782f9bc3d353e75622a5594d442f626fc4b92aa5c80fef484a8575abd77f53ed102988536b73e90505371cf1f49bf3274d1f242e48aabb755c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f63e7cb5fa5e43eee7a5c08f5a88457f
SHA116d2da348debc3a8846f17373bf1067eeed0242a
SHA256457e93e90ef0a85dd9f8f665405dd940f7a3a25c55aeab847c44b4ca2b47c658
SHA512235a2e1e4763a6cc857f3ca33bcd6bdb0811df01adc5540a142d7083fe88a9139c62266718d8355466a224e01eb37d987cd3c69a40ea9dd864bfdffde36f8e52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541dad607c84442179333ea9462565534
SHA15986bd125773a6832296cf35f4231311de1f1127
SHA25698f2f1e9d2581d9a179e47649e8a2a5fe3079d9d647b71063742473abf8d8435
SHA512bcc7818120859b2cd22a5c408dfb070011c241b0ddccdcbb6c51c51e126a1851c1911ee8c8fb720836d9f224f296fd43ef4445d3b6caf4c6f32b28e9db9d9379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d172dfb504c676a02dfeb4229f44046
SHA11b5b34fc06f7b55fbf0e1c0aa602c34a1c6a4ddf
SHA256f2fabb571b72bba473d31c0d16986074832562e9a616d51b9443309eb5ad6912
SHA5121ec48418dbe6f7a2299de8cccbf5d8e9e00805e564aa92979e68c29df178540a8829bd8e67a26591e3f5c8c7aa882800cae4f463af125aee687398292d887ef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503b111f5a0be82df10873565d26e453d
SHA151c02fef92fdcb25a7a5c4defb5cdecc5f805783
SHA256a2e0e9b9bd0d0e7ab865d4f5a7d48693d43ca0051e56c039aa6f9d71f7b19298
SHA5123a4b099adf63f2d66ea0d599fef32fdf78ef8141742747f2d6b85f67cbb27b9e074ec7498c72f6665dfbfcb205821dc22940d73322d0ccd40efeab6e3a6a89d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c02e7db1770f61dd4ac0b0c89a97e5a3
SHA159c46512c03b3ee232c67aeef6d75260f1000a73
SHA25606a1aedae2e9fd021c327fa45826848f4b322a6f26e5f8c61fdafd495301112c
SHA51259ac411eacc5ed7ea4e1bf43276b6fef7f12e2623c889dbf5b2f20448f338a0425a03d01ab887db0dd76ac6db8694f7aa5ea0d4ecbc3ced40538a8224ca841a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5860af0ad24dec44a557a2069493d0cd4
SHA1260b6ec3819fceb3225577b5fa115c341f1219bb
SHA256e767564ba259946f2c82c0ab970534b4da4ad2b5614162e0f8b6864094c8f9fd
SHA512426b814fc6f31c74c5370437bc6d6aae08c02f950a43dc5acfb45bba19ce2a28c54c8e23f909072104cb43f3ab39ae6de3043d18fece1cbade90b17c03b84e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537c64051bd8b37701c36895c11803dbb
SHA18c9db03d81710c810acc0c6ac004e955474eb599
SHA2563d700ecee49b9503ef1fa04dd7f58b0fc462ab79e9c01713864b6306c045e13e
SHA51291a00bda279708925271b905303728ebda223aa418a31362404b9e56d7664744bb00c343e794f81b20c78826d76ee4fc7e4709b0c02f0964a6d34bd01f725dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7a4d9c82b5ae7ee6a4aa7e46c64d779
SHA144ef37db5d3e9b9752232266b04271784903f025
SHA256f3515fef460136d2e2a6d35fab6646ad7cf15dd5bbddec5f1082d3ae95dee5c4
SHA512592b323e741c6ef590a0af8e926e2fb139e294f390c104592977191c01d2d3c1afaf3c753eb2e2f2afa02057f30ea66e203161a9eef4c861c390a70801bc07c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5068e1ac98eeb6fae1cdcd7a38be32ecf
SHA1bb8afe02c0ac0c3a0062f58f8ec66cdd29be4cf7
SHA256d44dc58b94819636d48c861eba273d85f8ede2fc56a31001cd995e7f93f240b1
SHA5129b21a8f6d6208a21f4a6c2feb6b1daef8a0375dd3274d574bb08e09f35969eaf73440fba3857333e975442c376210c273154623b8b16837cd940d61af2655628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0bc1f39ccd7cbb3549c0fb3e05bb5ef
SHA159cf38094007c3854bf84b48f107dcabb9db9e9a
SHA25636a5bbb116663545a36f45698c2779441fa37a7f695bf6fe69c6f18dc91f267a
SHA512bdad324f430b05015d4bd8d539ffa944eccff62616bdbe0ace9694a3c3926f7846d25befee4a519997535f257f3fb1b97225185804a150701cd0feddd3a852cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50253b8d7040ff57bbe500e030200939c
SHA1ca13a2426f54153505f64753fc5201b6f9cd4e75
SHA25653e7e1f86eeee5d5852f1b795ad06acb5a891a88d23121ec2854f8411755745c
SHA5120686a27b204eca14659ef0835e4728adef5f79e4f1454df0c4e35a16ce86bf7c8e09f02e9213c15872a49c734a495874b3799a69b75375263ad944e55c75358f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cb261ced66ab1eba2a59723df419bfc
SHA1ca0e96b8ff7eb700b09485c2125462d523c45c8f
SHA2561b4cba8babc748a4d6aa5ef5c160c3a0d2d430f7bffbcf465ae6ecca82ccdceb
SHA512df492a7c82652f02d3c08ccbb46609ae01982d661071807f47aa5178dcd13aac8e6284f5de327f26af254def78ebd41177f76a58a22d1bf72bb0903af29a85b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdbbd3dfb4accde296c304a4c887b683
SHA1a909b88b7cbbcf335925813840e577a78ba54d33
SHA256623ac891ab8ba6aca8e1ea08d49b0fde49a4eda7f0fe159ea14f1f9fce1d4e8c
SHA512384179ddb12a5ed88f21a0dc5503aa82637bbad2b88e24fb630b5399176603b2ffd9cd915768507bea6482f1794d2cbd25eae820f9bd2ea9c9953adb599e869b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c930f0d99172f55fbbb63ddc26d9ac62
SHA12105294abb8b012159348b80e58164ddd6399d86
SHA2567e7181c3a5104f5e98eb8160498b073929fb4270020455764c2f5777a551ba79
SHA51298544c4430784c3531ca1a464f7e55ec9322653182d9bc9f5c4e9c0606fbaa8c4b01b70bd4199aba05540d2ec04dacd67eaea6ca97ddf97e43742a45f093fd43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56af2e6a0c2638735fc10b362ece9cb12
SHA1b7d1a68d425c35cbf3f0dba8843c7441a318d996
SHA2560d1ddaf47575648e887aa757dafef82a7e7f8555d9c23fa2d81647cc8d29dfa8
SHA5129cbae6be2a27b9955c154b9c68b88849069ad9a7da5e7a5ffb2a61416dc9fec7bf9c325d7743166f349b2b75e50a906dda43ab0633c586a48bcb67614dbad64d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c509dc13621ec7f4b86af60f2fc5ebe
SHA1fd5cd175f2ff52a732543583e33818490fb82b82
SHA256a2b51c58d2c6b101137f6b2070f08c0c4253285d28c8792092d5a3f3d70b4194
SHA512b87f0b4e5294a185ab4b85787e70cd7b5767f8d27b000a8a239071b9c70d99206e684afaf46e9fa744c52512c078ce1992abf7163418a6fae768c403c3c15b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd8555b8913308df5ec4ba57fc0b2eaa
SHA179056b2505c8380c8f6351f82bd46cce9a2d7801
SHA2563c5fbe85c965eab536b2e6bcb42ec21f5f41064db992002ccc855605a7af6b4e
SHA512507b0e8f90230abc50b80742dc6d9602a1acc46be65440f0ad092dac905fd1ea958fcfd0ae6c9dba4c6a6e0b521db89ef97f307367e19036b5d39a2b7502c446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adb7ff309fcc9111710a5ca0e208d635
SHA1ba4cf9b316ad62937f4205d89021560e835b288a
SHA25666a48decdd371e0c6c978d4b86192265855ddecbc2338c40d31d6d0fdb8a1f23
SHA51206e295b0e843f26b0aaae1b8c50d012517bb734068ead8430abfeb1085887456551cf6f44553f9464782a380703d7e24929203dd775f99e7124a351a9b871852
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b