Analysis
-
max time kernel
139s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
c884bca17a0e73b2bde949523b4dfa9f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c884bca17a0e73b2bde949523b4dfa9f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c884bca17a0e73b2bde949523b4dfa9f_JaffaCakes118.html
-
Size
130KB
-
MD5
c884bca17a0e73b2bde949523b4dfa9f
-
SHA1
4c9b0c79a550758939db7eda1634e6ddea1c9ea7
-
SHA256
4a8773525cb2cbfc356492233124a8c9167d29d8ed87408b36e3c6cb8f9a3631
-
SHA512
fee85347222e07bd9303629eab43efba6f49f1b81c04e9559c365eebcce7544565712e3fac96ef9007dea9b631dc3d35a97e25cf00f5d515897934aecd7e3fe1
-
SSDEEP
3072:SIT33wmcrAbyfkMY+BES09JXAnyrZalI+YQ:S2cM+sMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431083620" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f988964ed49842fd30bc3b264545cc9a2e942bf1832a09ba5c1d7fde505c9584000000000e80000000020000200000007dbea9f888362e5e3acec94d40fd1d8415b31a3575146992354c841de2e2378c900000008cf7bf1c5ff10fb5c510e3f9b308353408d9a2c8388e7750a0b15e5415f1d9a54b311a95b14e4521644eb51132fd02ec015604dcf68823ab0211145803edd167d8ee4775f8ec9111ae0d24e4fa054d803998e733c96fdaa719fa43e55481b241507e309a61d1cd2a3d08f5642cafe3f484b8866aa119e7c3fabcd27728a16ad5043273e9915b4595a4b7b954f4e2d4cb40000000b6cfc8a1164e1deec7372803284a82c9951a5610b44608d73721c09b627919acff03437ed16d79b9b58a5d2515624ff80029a7b1b9d8c40b64922b16f02b328f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E9DB3E1-65E4-11EF-BF21-724B7A5D7CD6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000004e17928fbde4e8a9c42a53c5b0458dd6bd7f5b712f038a630348cdd0beced351000000000e8000000002000020000000fe3f09bfeb2686c1e51801432a193fa916e17c35c7849e3c934818d42346b2b72000000091663a1ca040e099c1cbeb2276bf92304605518085d6fc6fecb29e0066d6b3a2400000009608425d15d95da3f4305b71ea6e71e10548cad8a41abb0ac242da9b6ce9f1b212fdfb2eb59038134b6f9525254526f1d14ffb997155f426cbe0b7996d947331 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0dae593f1f9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1776 iexplore.exe 1776 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2336 1776 iexplore.exe 30 PID 1776 wrote to memory of 2336 1776 iexplore.exe 30 PID 1776 wrote to memory of 2336 1776 iexplore.exe 30 PID 1776 wrote to memory of 2336 1776 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c884bca17a0e73b2bde949523b4dfa9f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f6d0e19552656db101cdfcfef52ae6
SHA12f05e55f0296b967ed3518bea099a884c93603f4
SHA25621488648039c1752611e047b2e948d51ec53db57bdfe1e8e7f11ec9d91c87a46
SHA512f88bb15cfdb71cd4691b4d6ef389360f5ab6285c7ca03b6c323f6268d477c15fe9da753236cd61a041254640e70a3be4fba7d662c033b7320f461ca19862a9e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d9ca82c80bdfe3bd44c6cb9322f0bea
SHA102630440041f0483f70d784ab906eef513dd9c58
SHA256e4b751c92d58abd387d3f0a8fbb5e6cdce5f27c8829a116fbecd41fcdb547f65
SHA512f05805a99df052cc6f46998641ab890d4d08e74e2240550af853b333916fd320a1f8ed3918eee76de67957cd3cdd13749fe88022fe63fcf8f9ce093a610213c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b1e35ff739b4ad4fac48151f43a420f
SHA1178762fd7d144e0472aeace11724f0b2bcc735d8
SHA2567db3ab797f2e64e120e82c7880b493e855c5d72f673b2619620880cc44179aca
SHA512b62c8c77b06425a21e906f1cc175a4d7da48f19e763f5561572045ef7ea52cb78c787b47154405cd0fc28303ac479a48dca028fe85d1c3e28ddf9b0b877071ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504591c022c708c1954198c68369a4e83
SHA1057dab489096f59a0a07fb304cbfb66d0351a6f8
SHA256336b7f95835782c9937e1e1b634783910f35ec8e8e2ebce3b3e008a3adef88db
SHA512a60add16f84f19681283911ccb410536339389dd46be1805558c17b65dfe12886cecebafecac4f9e2bd1d1bd2dfc86eae2fc9b7363d45701f6775af55ea9338c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3149fafe30544d36417677b4f4325dc
SHA10fd291273ebac84468ced3dc2af62a49b1bc8bdd
SHA25642ffef3844febb7c6bfe6a5808b213f8848d4bd3eb09177514ecbe05c8ffb5e0
SHA5128f5d1cf80d408ba3398e8d4dbce4d7954a49b25bd53d54ce095676f47754a1f46ae5427740f06bf590ff1214d92c9cf1bd1c2cdda56dbc9b89f7dc1fcea38dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51311259c10735dcad3039549d2ce3ee8
SHA190f951b48a48500be80a10473696dce4c47dcda5
SHA256621ae225700a78f1ddb2b027da985f3d4be178db4fb472704386cec49c6b81fe
SHA5123c94c16fd527e7af02d88babc949a44216c38a81c97f566cbd5b27b64da3eeb7d4ff32fbe5f0e93e0888e07201fd0e2c692824e861047eaa7f4cce0d9b341e4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c79ba9bf5f2472e7ef799b3121e3c9aa
SHA1c0a6b4751c3fa687e561786b9c77c4faa116e5f7
SHA2567094b2745921c960356192414a217a5d2ecff27fcb7442f49429e794c37b15a6
SHA51235ccd3fc9eb6a35834db75f2babc5b51a956ccce5aaffd5878883dd9909282d04d73603e85672a6c9f248f7767bca60133fb2eceda23c5c19c65d2e363c20e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52447cc8688fe76d6ec408cd92241276f
SHA1fc2c9866dd66a16ce5813b0ff2281977902235c9
SHA256874a12f58fd1e423e057a36c0eb8fdbfeeb7add86691f26239761f0e95b18b2d
SHA512229ec5efcbf5eb4daa521a0f3a849db3bd93f1a539f554038f086cd8d6c70191f5c5b113b837e5b63003f45b08f11cd8850b26b95d22820c93620d4bc101cf53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521b267cde4f3b182f89a56fb386e597f
SHA1fe6ec8ba1fc59f168a7843cd15f054ec26fce452
SHA25600bcb6db013b4c56d345831cea3099ef8d81fc0c0753f5f196543e182a9ecccb
SHA512bd43760f29a4b1ac8acaeeba5215383dd38333901cbd492c6fde3e020ff4bb98b973f26cf3eaa9cd30acaf01b0352091f9753288d015c2f0cdcb9b2d15580d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a954067d2d09f636b8cc01505e753794
SHA1a7529dc299c6a32236552b7f8e56f3a846efd113
SHA256569fdc3ab74d6ebbccbc8e0b6ec9128ccdf94773e7b892716f9fcc3858ed1a7b
SHA51267de93a2197303204e4291c67b9e645d1259d1d0f04563fa36d8d61a2346e03bb8f65101ee47f73bf75dbc27cbe7a48b48368d2d72b1795fe407bbf1857db7e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c446bb1b529876249d60b3eac676788
SHA17f34dec285e145d3b8a3e2b5c19000f7775c8903
SHA2567b5102cd54c62e02cba931da791b6d76e1899140597cc62c5f2911869f88abde
SHA51208f84563567de9586d1dcbebb3c520dd6f16af04fbd6259a5007b626e4e416381aa77b1f3051a94c9775e5cf9e492f00edfff2aad1e008aff3b4fbcf05486341
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588acfa98ca7c01e2c39cfc3fb17c9470
SHA14ce04fc8057781cd02c383b3cfc1d96aead860ab
SHA2563c6bacc2da3dbfa980fa0426f92b2808d5db15371dcea39b1b4176c5e7240911
SHA5125d229624669e375f74f4d3038466fb528e7d6c5f2c65cb8efa930871df780d3fe9edbfe8b54ee99cbdb369b06d9bd155c0aeab8d13848a71b0e29c118db2326c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb63c19a8d135a164f97045a45c37a1e
SHA19c7227151edbe3c5551d4b71373b7e5ac53d8e9e
SHA256dcb082636153ea39f7f18e06bfe8f659880b5aa697129f30e9a503ba6665560a
SHA5125c0e8dfa353f89c39d05eac4534581c4a7555fbb241d884191b843130631e96b925e765636ae2cf9c067bcac382d805ef408c18aee5705e2ed2ac5338fdd61d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5524a9242fccc303fed47d0873f9dbae7
SHA1604b892f1be08f43e7c6fef65bca8a6be0d73df6
SHA25654381975eaa7fa07675fd5e8438c6a1802616d8a1339e4a912b0e9ece707e6c9
SHA512bfbd57b23532c8d96f55f0a9dab312997b763a62c4c664524e70f02f3cd6f94dc651ff538d89ec6a1bbb830c96bd8e1fe3d7192cb61f913bf048853fa0293f28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bddd4ae9fca6e56d5f6e5cfc9e5ee1d4
SHA1ba76f93e12ebeb40c72c0155961b38c8a79e6333
SHA256142193ecd49b7585be4b86ad98e11297d80c62580a18d669d83e3e68e8664916
SHA512510d105a23c8dfd8098b0ce17260e2b21d7ba2238d0e380e68a4e441b16462945a37ee68bf7ff0ed665df474e4eeef41bd3666864ee45b3c91457cf929466858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4e5a99e96fe0530cb6cceab691ad239
SHA1cf381003461f17388cf309c782e60f3131d898be
SHA2562cb6387cb6b2dbeea1c39b2871f483c8eee5ab5f837981a877399201c4c607a5
SHA512f07aee17510ec4a9aad2c0c3ca59407178db50e2357c499de2f13f349e64e7f24b52860b524a9f7f20b6c8ff5443e8002c65fb8326771cdf5b2b6c90f9ac878a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b