Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
c8a673a69623fc8bc6a9cfca6c3c3138_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c8a673a69623fc8bc6a9cfca6c3c3138_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c8a673a69623fc8bc6a9cfca6c3c3138_JaffaCakes118.html
-
Size
246KB
-
MD5
c8a673a69623fc8bc6a9cfca6c3c3138
-
SHA1
ce63966ca9a89d384b17d532089a95dbe00e2ffe
-
SHA256
01d29587847a4710b7e8405748bc0403494affd9245e58a91c2513ae70a76c6c
-
SHA512
4af2f50113fdc0785a00cbd5b0bd1faab9813fd5fa79bb3ef00f9aebac6732169304c8f1411a40be93ea75b740dc498fa9e6c4b20367326c84a075d83fafa122
-
SSDEEP
3072:/YZ1yvAhZrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:01vdz9VxLY7iAVLTBQJl/
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB821A11-65F1-11EF-A543-CAD9DE6C860B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431089413" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1644 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1644 iexplore.exe 1644 iexplore.exe 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE 1532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1532 1644 iexplore.exe 29 PID 1644 wrote to memory of 1532 1644 iexplore.exe 29 PID 1644 wrote to memory of 1532 1644 iexplore.exe 29 PID 1644 wrote to memory of 1532 1644 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8a673a69623fc8bc6a9cfca6c3c3138_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD555e52762ad96dd811665e761eb59ba8b
SHA1cc236203b75a9e7ec066660d1445b80b58fd3eeb
SHA256b4d280864076f85ebe04f4619134eaa9baa18769576f69a590c6f9c65cba07b5
SHA5120b2ae3fd5ea5a8a10b8f125d839afdb748f39cb532a6d1c441bc09d5d156f0690f7392ed55369b9f1cc91b29b908463d7dfd1d6b7acedc59e49a45398cb68e52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513fc9fb59a74af80a13dd8a021d2c005
SHA12f3e220accb9c96a0b69d208ae8645e790ca2d7d
SHA256b0ccef2f68767181feecae7975860096c1c3ecc6d2fb03c8f23539e6566e9972
SHA5121460ce9f750b84d00658e74890ff455ff4185830293d7e88a72cac93f5aeb5216af6dc34e6a194f7a7fd6503a081fa4d0b4f95faa7a42dad86f3e64804e2fb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595d8c0c4e72ac310a9726ced83b835d2
SHA14b02200928a8551e529aace99ac13e3e0901124c
SHA256f983844ca805b8ec7a27ce7faa4e6f949599a99947b8252422c56b8f2180cf11
SHA5125348f5e0713067aaf4fe913b50154135493d4a12c21975dad6a566100cfeafb1290c8f20af21a1dc6214331cdd132c165aeef2b21afe090adaa144680ca84985
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508bdbb7e77f4889f7935eb699199a255
SHA1cb8f49232ba71a31e6fff29bf379558c5c45e151
SHA25619a741fe2b0772a13ff79f72a499c265fc9c680493d86dbb981a8a0ba830e69d
SHA512d88aa779b272a1130b8fab06dc9a491dc6ce5da190b306aefa53e384a828cc4611558a3a6e456b0136fecfc4acccc20b1ccbb129b30fa6d72d325d183f7905e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d144af5497a37ff1d2641ec3c9c08b8
SHA15f58e6e09c48e9447085cf80b3d986f3919346ea
SHA256fe367b2d03263641917873b88fea18fb2e89d9b77022e19aab0e84a38d9de354
SHA512cef27b5ae8517a3ff4c34cbd7487ec7b95ad203ab4dd608f4827437c18bb36dbe0a4f49b0e091bfb335e9f317cec301a0b99a92b899af3917a13f0080f45c8e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b005b22bda436b656baf499c85947469
SHA11c8a5c8206979c34c2238b424572e29e338e7fc9
SHA256070817e58f131e6d6450048a63301f5daf0a5e6fb0a2bcb1486b09cbf2c02631
SHA512271ae04e33d4e54de3d5fc2e0f8d91cd42d9149345c9eaa12c5f64d41a365a72059c7e2bb8a6bdc4b1331a9ea5987fa7aa5ba9b655fee1093e6d919e3b9f2cfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5133ac69bc2f0e05d9d51f1b3a3754356
SHA18251a4853b39047592363c7e3f61c2f5b03f12c2
SHA25613403ab2fc19adaa8cecef1ddf584bf08e390d3a048bbe171de591a7165d371a
SHA51234aad1c083bb7147fc5ca9e2bb35bafd32a473ac2536116034a2565a7851127c9dc7b717cc75414f4c0ecfd1f6479438d5d4645338886953c505c079707af0e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d234aa351a5916360d0cf5ec7157918e
SHA190f7cb31e5224e1605000f7ece9e436eb2d4584a
SHA256aed2f499108e2be41765029a72957543d9c6ad9a6e994f684c0bb7c1e8c1a18a
SHA5125330afab09d544fb85f46fdf4ed4a79847877b9568619bf45bfaf0916f0619afb98456dca67b5676c75169c75d49904972fb745cbbb36ca9661e4188856dca68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fd3d314d77aedffaae78a4d8c4a87a8
SHA1554dfe2297e9b91a47b12dccc931b05af5f13966
SHA256c57fad9d068cfd29da82ecd9bea52867ba4034a00772304a7ed55be99a090ed9
SHA51230f6fa583eb0bb52fc7615f3a64fb51dcc8d12d46256edf062dd76420cef405945e3cf3d3acbbbe623bf0b30d7181af702752d29cd16e833d9e881dea5611378
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fff05f57904184e6d3235cbc5b6b4686
SHA162c98b138e07db8715fb182f24097007aa242a89
SHA2561a43722baa63b9e4cf7194506b2face968c0b650afdccd77afefbe6d1c5a6bae
SHA5120d080803d3f4bb5cce9752cda85263a00160cb23f5717a186a66628c871ce10e644135cb7cc09eb939aba4d4b82f74b26babbb1d990ae1a4eba93ea7b72f1bb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508076d184b2a39c5eb856e9f6aa98ae9
SHA1bc4260b53c9caed0a25dec0c3b0e5e3f29072ab1
SHA2565140f7310dcb07b97281b791055bf9246f86ce23542eabf7499ce2b66be95d78
SHA512eda98c515e6df4a5b2c126f7787d119d03d01389c065b8fcd3de458659241d9a86c0d0f14aef4c1b8e323f31be1946be0e8fc1c3703006c8f2c3e8ebd4c6211d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ebfbb1d92414a6f90626f94174c8b617
SHA1a7f28457eecbb9a74b2c05961913fae7f7b2cad8
SHA256a152b250a030b522df5e0f36da02c963cfbdb177210c38babe3c7e4a784252dc
SHA5124384ec12b9787fe2d56ab2b25114abf2c8de98489753ce9caccf1a7107adf77d02d62a2c94ea9fe2f2dd9896e39b41de7fd6eb1c1e0f1d3d2fb3ef719523fa4e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b