Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
bf08a792cdda45701e9b82cb07f303e4_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bf08a792cdda45701e9b82cb07f303e4_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bf08a792cdda45701e9b82cb07f303e4_JaffaCakes118.html
-
Size
19KB
-
MD5
bf08a792cdda45701e9b82cb07f303e4
-
SHA1
0facd6244dd7579e20b101c340b839bd06251faf
-
SHA256
2e50da0b0e6e56ece0af3919b33b92219f1f99d241c7dedf10110ec7770ab68e
-
SHA512
7252aac61426023f60df4c3d65b09fc748a1e5451b3894360764ff0d6d4452c40b4b8fea121029c771db2c2abfff6b80ac89e5bbf7e8a21d1ede1c8cb2de2986
-
SSDEEP
384:zijZKhgES2BVBD8cOQ3RkBfBvGATemLxXucfIk99heVozVc9H3h:zij6S2BgcB3ypvGlmQOIk9SVWqH3h
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08DD00B1-6239-11EF-AFFE-C20DC8CB8E9E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d8434814c5c293aa313d7af4518825d0c1f16063a607820bbd6cd606fde883d9000000000e800000000200002000000059f60034dd2a3ef28ca31f33ec838ce0f0e97d5036fcb4fd8a02d570f173dbe120000000c8c9e22fa8dd227d0cb9832fbf545b41f4c4952fa58ff1c3ab3eae55e6412fb84000000041e645f2a9b3e7ec3c9497c5f70137a50d99ad3067aa73abf63f338361df3d430c46179a374f868fcc620815655298b14688022d0c470add941407d8d6336ffd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000006bcbcfa67a7430ca3a316ad8d452d744968e5996546237bb1d6442d67d5eec64000000000e8000000002000020000000ee323c7c19eaa7c882ca9a03a76c385eb0e256a59924d9793132e138f80a58d190000000d03f9b08dedd756567298e556e8e755a3a1dfa71c12bb2c36a77b424bbedbff23550c11c319296a91104afdb5e1262755bb42c8a08b9f0968c94e7024738a1c42909228ae70015e24403794e5aaf6d8776adab99b40114e17fe75b050fde98fadb69a47a737d5142e1e6cbf3e4aa3329e046b9631184a4d4c8d204df803dd2b860c8145d6f6d6720888a7696025d292d40000000272bd353605e2820102ef1bb73df120941fce20e051668d675ced2b055342d390127a19b4524ab36cf35671a3218b56b33c0c8cd473cf463b63f6e1192616dec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10906ee745f6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430680124" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2072 2988 iexplore.exe 31 PID 2988 wrote to memory of 2072 2988 iexplore.exe 31 PID 2988 wrote to memory of 2072 2988 iexplore.exe 31 PID 2988 wrote to memory of 2072 2988 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf08a792cdda45701e9b82cb07f303e4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549ac0cbc765e1d3e69a5c1acb59e8a78
SHA19da9e8656844d302a542ef32e5d1ee7a8453240e
SHA2565e6458f95e4707e54caa081defc47de799bacae796ddc610092626ba0a11b41e
SHA5125442a283b54dae4085809021e8e96a98a1898bdfdd7386d7839a45fcf12535c49ff121cbc7313aa34db37005b62e225053e55140a217b80398851ac1c761f298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff71fd1bb79482d687d52aa80c27d3d3
SHA1e2fe2b4d87d2c210b99dc6b1a922bac5a388763c
SHA2564c35378201bddb3930d61adc681d4f799c0d6ac87fd06c21224317f07747f57d
SHA51265cbfc777e94e467dbbb90e946574f04ec6107f1e8b632fdeb68dd1eb02eb5b686c77d10333adc854bc8e5cd708c9b52480395985c8073d9ab7514a0f07c25a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541bb57b0af441853d514d99562d7ec1c
SHA1e3e37289232f7aafa413ce3158a84c6d8d4f0383
SHA25664aadc460e1f1169143a0255d42111b0e5c1ea8165b471da351ca6bf7d0988fe
SHA512b6fcce6dad95f2d8468211c572c2a14199ba091e5492d62c6b64b9c6abf21a7fc6964453d0c83111fe3ece8a6e77b32de7c76b68ebba2776f08c0670332ebe88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1728ec340b0dcb3e70dd52ec5006542
SHA1fa0a5c2258e1dcdb44536d121fc9c1e41b84a120
SHA256f59f95b61ef7e746e3484e3b4a017f345a94da94459372f527cc535f98982247
SHA51208f9429bc3363012e98e2ad3f49365f3a1bb7f0b99e425381997f0d95505315ff414c2086d4d5a908a7f4fc1b003a519712bd55d75e6ff99a2b1c0e5786a0fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d6b510561ef6929c83566a3b18ded73
SHA1dd0b50b9e3f0af76ca7720fcd6ee57e29ebb19a4
SHA256ffcf3ef1882f400950bc44ab5d8e9d9463eb73bdcd07b5e89e1af32f389d6e88
SHA512fce07c7fb0dc5969163e6c1a636fa7c4e520f448ae4a34ed87a54a078f7587e2cf18184ccc51a8ebc1898fac03340162ba155b502ef7abc02be282bd2f4fbbd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587b838fd387bb62592813f99506260c9
SHA1afe4d80bffa057980a0420995aec3564e34be052
SHA256a1f568a19527f931b8c74768d89284dde1f291524867e3e4edb2a568f213d673
SHA512d7199ae36bf58672edd60122e05c9d3e8bcbb3dc200661e9e8b5cce934aaa7c4701aa40376d6299ced9a993d0d7e8dbdf442087698569a4cb9735d9bbfefeaed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506fe387ebbed7a2f5bb672ae88b35329
SHA1b31b5406bc124df61721a337192afcf903ba0dc2
SHA256f2e6f9d7d254d5db55066613162a2b29929b68f1bb1b8a64d5368faa1e2e2222
SHA5129c438dfc8133b1cbd9de2d2ca9e8d5d91fec1f957c6fc0a5347befda55791c9ca29a8f16d2a024fbc9fd326e9deb6a2596b25172c27241a2b1efe15ff4356874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ebb9622166b9ba1e9ae3365d83e407d
SHA1e604dc990e5480898db18074e573721b98c5af9a
SHA25617e131796e6771586d98bf77eba1ffa1b2701f10f1a56646dc9f33125cc9983c
SHA512496467b04d37c04f9334155843ffcd934bd2d646af61fc277361456421e935a0b421a13ed3c8adeb820d19505c3779501f9e846ee413e4a8ec5a6cb69bb87f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540f64965b8f1c6639431bdc4a6138819
SHA1b49aa34e5dc5e941d8890fe66f28df33334ceace
SHA256585d1b515b64eeff68a9cfff254748772ebd2f56ce3d02f89a19b3cb72d59f33
SHA5123c4753701c7f905a76c354e5bd2c2c43bf4aa64de189fbccac9ba873c954ed5b03624a64a1b57449c4644f26662c83ab00dd00ee52472d6b4f2d114742546c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3084457365e4307cf19fb708011617e
SHA191b071ca0bc009637075d344ab9b72f686daa425
SHA2568a6f59b5f14f9b4954e860c19cc9c04470bcaff5b272bbc08b2b90e07630b26b
SHA512e7ec3e030637c2b680c25f34bd4f2ab3b324b1e8274336753489a7dd6b1edd8ef5fd84923ed94fb0a973e8219316c3985d990c1054b5c9e260a030c5c9653919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6154327716b4b6aa46a176f274d39a4
SHA16e7790569b605c0f3dac64ed5a5b7680cbbdf2f4
SHA2568ef20bd2793a921704cf8800bc8d4dfe379be391c27d41a2584cf04f51fce47e
SHA512081467c5488d4ac16a694fb906cd3495d40573d23eb46561a302c614a9dba4ed429263d9a972b0c2332f77f9142a95e20b73277575d4d28b4cf596b553b6ef9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54410b67132069cf2474b28ce7add3c6f
SHA148871575ac03754ac5325f8c555fa784a54788bd
SHA256846a61440cc42a05035a24643a052b247bed14e22e73859cc061e79b1083d732
SHA5129ca183b470fbfcb8bf813af488067dc49337be6c9e64c7e44c05355d368e1b6a08799802308bd7c44140876dc2f7016e0cd5d5bcf0c9585340f0265d2ab33300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5061744b8ff5197456fbe74a416a9ba0e
SHA124cfbdace6f31ecb8271d5e184e63c293b28a67b
SHA2565186db3abcfa95545565183185348106191cb2a2eb022e7cfbe878552f037914
SHA512760160ceea78db0737a891d3be96e993e3beb75fc9944898345b2089374bd7b20422e431463ebdc1e9f19d06dd3f6e8e27edf0fb512707bd5207c417812c7638
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b