Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
c194583e92fae66700584a4b8dde0702_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c194583e92fae66700584a4b8dde0702_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c194583e92fae66700584a4b8dde0702_JaffaCakes118.html
-
Size
29KB
-
MD5
c194583e92fae66700584a4b8dde0702
-
SHA1
5e4637ff6456aff630fa2a37cc120e6c01d46104
-
SHA256
6b4e2facbc2072f0067e4435af8dacd8022baf2b177bbf97217aedae45f0ed86
-
SHA512
4eb9bc4ffbe4586cffca799c40ad4a72e9f82a5835a2a62db4553dbc548da959bac0e9f1407483e21ed3efc56a6a15bad5f9462478ee786d90b5ef2159cd861b
-
SSDEEP
768:amVrybwb8e+84bA46jsaH/N502mqYvadnkX5TvN633F:FWecN6jsaH/N50sUa53F
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b99b4532f7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430781660" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a63de585b2143609b25c06dbaec66609b680aebd4333638fdd91dff7656d6b10000000000e800000000200002000000019e1dd42e638a0f007bd950745871bc1b83466b5976248cc7a90e3c47c9f38d02000000014e08c94d160392c2ac9cfbbe5cd44e1eea19b9de3c0baf4e31713b227a3267c4000000065714ac2206ed4053364f126a20279e2bca250f9b632526c826e8efde19a8704a017626e2fbc5f981f8c452f37739190ab3c9afa3399fb8b31345d8d8dcacfde iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002b7dfcc377aa3cbed7a165685d07b282707d6bf5fb9b1a1f7d583b984b8be0e7000000000e80000000020000200000008dd58c6caf05b38f01faf6df56dff46026503e6db5e0d07623c7c88239bc475d9000000065a13be09d75f693c3bf0c44d704fd04e6dd469a3fe51bf8b8c48f0abde3f7ffe6a296381b1665039ea412922751b4e1793bda2864081d836bb6ef6105553243d7bb7aeb1fef41cf9aeafdabfedeb9946e88d1244f872bda8f2a5e21cf0665285abdefc33bb4093f538d78ae0fab65c3ac2a060f1fa462a00b5753159387cb4fbcc0e29ae671a841fcff6ef726b6077340000000aaa4b105b3657a73887675f2f7b65791d10d596a6aea6974650de119b7cce835bacc499bbafdf24c899e7692512dc09394c9741ff88dfebc506db342f03ea4f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71078241-6325-11EF-987A-EE88FE214989} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2692 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2692 iexplore.exe 2692 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30 PID 2692 wrote to memory of 2704 2692 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c194583e92fae66700584a4b8dde0702_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588fdcd1454869509c2d1daf5c4e49ab8
SHA1d3b05e31c3b1bea65d79a2942f5151abe5e089de
SHA25601862839e916c7e0ad79d96998f79c1ac10340d59d5dd3ef3800cf9be274d349
SHA5127b5211e485dc33e79c05b3fd8fb97ce4c296039d9f7e7557768fc8ad866b0a84905eacebb812ecefb410eac03982f0f9bda065063bd7453a75ff0e9f2bde2584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cca559ada59f2300c9db6390bb1b17c
SHA19c5ff9c330ce3c9d328cd432e1e39b6eaddea005
SHA2562db7fcc7fe3cd9d6874e319a0a2ba3249d6b5c022756a0c1e744039fbfb6a255
SHA512dd5bcc5afc56c3d5b9b27b9c8859f7f732b85432296c962d9672e18daf585174526a82143637e6d493f996941f57b6f68bfaf658edc28c805e8226a5d842b4ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae8853ff8fc322262fc45f7cc884c931
SHA1af2a0aec3b80e3e6acdb55e1f9a579f7b6575f50
SHA256f7fbe94c3bf7ec0f561a2e08fe241113caf3b416acc6bcb5a897ac289274f991
SHA512163dfb5cfefac09d6c992601bcd53f9456712ffc1f0840ac6490635f011d94dd00e78882e4b0e4412161599ef3f03987d4487ae64c295d269610f9f96d69d623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50198850ab22ce2b302d2154ea0beb637
SHA13e532bd4a3889c027acdb69550f7cfdaa48a34df
SHA25638b6fc1b85406205a3e0f03edabd4d7ab606b418f0716547ca183651ef4e2ad7
SHA512d51ee9b9b45e9172f19098f30e92d8ee121c36cd94d9867e986ebd9957bc75628c3d1465b79d0da429c2928355eda18cd252e5e0d104a1c94f6a835371a80336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5909070ffea1eacff5e42ff29ed906e12
SHA1eaa966da340c68daee29b366eae377cdb968a8ca
SHA2564fcda4cd1f78becd1ed468a96e10a6207099459f4f75858069a80e99ab9b5d5d
SHA512d072b0f79e8de416f17f84d6d3fa5447dd6b62e37a51517ba0dc680269008962adeaeb12733750c1a42815c3c9137b1c94c091a41f24c547799535d877e42083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50be674b45087cb192f5fd83a254729b3
SHA16d9b1bc3827689e3b11df2ec0659421235c01472
SHA2567513f1b4a408982fef7b30aad4d063e6978ba0c6a50d04ec6e5f6de192739cbb
SHA5126639852046c4d5857e1785c635fe1bc07d87bd7ad237376500740be56ddc0372bdd1c1083f182ff64b59450e8db55977d177122723c5210ce5135b61998ad429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3dfce73165eb6d50d780d61dcbe4f58
SHA12234e704b7fe002e7d9ac0428075c4e201889dca
SHA25635659023349e9ccf99f17e2ab0711f65c038dba160e72046ba98bf64327d5dae
SHA5125371d9981484002f6cbb7b9f52a24a03a58ced4a9f88e9dcd2d8cc3201c1281831d2a37a612a7c7271bb8a1809dd842e6862c04ce97a5dcec5b125faedb447bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3bfce2c5c53cd363b607ff721590510
SHA17f51bcb2b84cefd199c7d9b1ed4effa6f26f779c
SHA2562960defacba7939531f7ed4d2dbf4e0ce86e912843ed2b20b86a689eae21247e
SHA51214c9f7a4d9eaa8c8dc821a8228de8871057458ab03756da2efff655b6ddc906bfbff2aae8a3782ccf3578cd9f44a46f26d93cef7efc39d82065bed500cca9f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540f364bb5585d79c7367beae960873d7
SHA1a178c5aca6ec2fb981e4539744691a386908eb6a
SHA256142bdce310fe6cb256110cd5f9bcecda757ec566d794e8158548c5e80d3d07d5
SHA5129972d1b8644c4c71b0b547b6745b72d1d9ab7c6b983afc0ac1acf5fdb1b64f17e6b0bf0d57cb7ae65c8a6c91da8a0dd20c8a6be9314597cc438f9c5ecd4e0a5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4774ae83bc308fefbe0e8bccc2f5839
SHA11823fb705fa4e366e4a13a21b688902cdeb11763
SHA25603f31e64eb40a704fbe68d9348e75a75ad420cab304314f7d81adfddcc637093
SHA512e00569d1fe8373b6f5f5370f9926ff8e2b2cc6cf42ae4261f1d1a519b780d84c118d939c6a844f8dbb32e0c1140636533993c6ae5f236f4df4b8664d7e6e4bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7265861100b963f9c4bf71548323dec
SHA1e53f4c79f3e9ed48357a6dcde18e50e69995bca6
SHA2569aab6d6b3de4c247f16161e605cd16559b3cf1c3059254e73f2bfab0d6238f44
SHA512c7fd49c2df6412e3d78dab21514d93a95d98fe71ce1c776ed13db0a7901fc46017846382660a9483bec91370684e6a05dcade0261f962900cf206e947598ba0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5819d8459c96ed76ff718e685fd3c7025
SHA14daf016f8f4c3ce0dc8954692c578a44945812b9
SHA25632a5a4a5faa9cdfce81120e14f6a367cd0eaad2a8781ba2050eb01c6265f4ea0
SHA512c6258d20ff88d38d6d436e9629d5b4765d5a4c3dde8b2eeabebab30fc23d329bb360a24a72428c6f0ce82338946255d44744ea857c288fe90ad0e7186f1d3c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddd954ea45aa01dfd3d207c650872e38
SHA1543c94ba7b2c0bfd0e47c9eb680303a92a323d1a
SHA256f4b8a5863b3a4e18fc52dc63b6a57360871ee84b6bc548db7cf0c7f0ea625eab
SHA512829d3a7efb4c8e8a0830161ef753bb93bc7b25bd4d3a10752a0007ba5966582f7e932276f973feaedb8ef87c3acca2df1f9e0aa1ebc4c2fc90044664900dfcb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3c74a3b6d496ae627901cb54bd4e2df
SHA1a3fc49bdfcbe835bb250fddcdaa68f5a6cb408ee
SHA25611c0fa6d32c403e578af451ce5999b2b4ed437d1cae80fc236eba05ddbb9365f
SHA5129aa65922d563bdd0a47c064a40793683f058d407aa0d87cbc67494801d408549de54a2c61266e1cf2f1ba572ac47502bbc7afbe627ea1d7588a33029d5257a9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a723c368b4a044383084f91fb9e74022
SHA19382028068f2f074d4deabb2d6213a13ea5d7f4e
SHA256869a28e395b86d6099d55a736d7c41470fec5ffb555c7c52002c5f8e06760554
SHA512efa79c25f32d995d667376762e23f062103f158fd16bfd09d1e2050c7255e3c2dbb635658a2ca64c2b9eb5ca52c2d8ab6d845524f24a85184e25c8471393a894
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52662345815dc19f4e5d01bcdaea64d56
SHA1e2d43c101e9a04bd59140bc512d0d0df74464184
SHA256d51de457ae35cccaa605c31dcd8bf3f48fe9e817d613a2fbfa7b782e94934c36
SHA512f089ce2dc16ddfa638c6dcdc8b933855b88f0fe96d8c4b0ee10a6559f218db4d5320ea1351eb20b6a4b33cf70ee12b3ff390b8c56248128a840828731fabdb62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5029be5cf8f1bf5e7ede9f1cb8c1e473d
SHA1286dc9554d2ae782c50f80c08a770378433a2204
SHA256b301fa6d00b88a99348417ad0f0781de37d70484a59828827e1f719a83d1e342
SHA51274ebc71c4732c7a52ae84b584982817bae12f7c717b97ea645813bdd3cfc870edd110845c324ae0d6fd886a8bf42bf4dcea543ffb5d6d8db70620a8e37e57f05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dafde248ba05725fc7fbed9c0a9d756a
SHA1799e721e1d4caf083d39d20b139a60cc99861490
SHA256687cd7f67e8313a536ebf05c021e95e9df290392cdb5982043fc0f5413e9cd3f
SHA512ae982de82eb85be22a62bfe74dc1ab41fe49a9f9c8fb71a9bcbb331548a1e0891fcd7ead4cb2bffbfb27ff7de72a3835b1afa908c3bdac4e073e665a0a03118e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fd9f7e8e8c76397366311f95112bc66
SHA1d13a8043121814b7bb29d89d302f44c3665d1368
SHA256d50ec7fbe0fc33a5bd0d526b75b89875f6bb6dbcae8848e5c37356214b2eb781
SHA512f0437bfdc66693502cda5dd821ff056c9e27f7ebfd0bdb070c6f231dc5b486d1d6f8619b7089f386292bbd13dc178e1f14fdae3cd5fe0a2182992619ab45108e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b