Analysis
-
max time kernel
136s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
c96896c49cf73b5215b4c24fd7c430fd_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c96896c49cf73b5215b4c24fd7c430fd_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c96896c49cf73b5215b4c24fd7c430fd_JaffaCakes118.html
-
Size
218KB
-
MD5
c96896c49cf73b5215b4c24fd7c430fd
-
SHA1
283136e1b0974d15d616c8d9c57b055c8017a136
-
SHA256
2234a87cb0eb6bf1ad14f27151fb1ec76699ef455f7b445dcae99f6763238d09
-
SHA512
162474a7fe530ea110808e0c2e51fab8d20bed6ebfc30c25cfa8aa45924963254ddcc2c8f93c389ffccb0ccdbf8a9e653975eef8a4b04efbf443c5a9e3cc4133
-
SSDEEP
3072:StQaHSlscs4MaqyfkMY+BES09JXAnyrZalI+YQ:Saayl8aPsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DD1BB91-6637-11EF-969F-66E045FF78A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ad4d2144fada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000008ab10c663669ee28bf3be3e39b9c959d437145f80439683647c331709ca7a169000000000e8000000002000020000000cfd3b4e9fcefead21311609b46dd5caac842e22627f0192324d9eac37559e4532000000036d0127b683631a65bac0e919cbfafacf905104899a2a425c15e72c59258f2ea400000000c2a4ea34ee7db9335ce79c9540daccc80427e228a81de1a79618494a041a305cc2209ebd4d119f89da5a408cd08bab52f07cb0b50d663a1df8791933613f827 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431119079" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000cd9b1d847976e05cb64397f6be33cb6563b7051b836169bb3d50231b134f0a4a000000000e80000000020000200000009fad80feed2dbd759d49ba5ac2939bed90f9b17a3728e97312d47ac9e64b816090000000711bb73f75e825429e89c3dc903f8fdc7a80fa027569769a812f85496bd09a796eeb7eca3a6903acba6dde745b3fb092ef0f433e7be68e9288dae9e7baba5e9bb9175e4da7426f32b96293087b71f05e6ffb4c1ab159b997c9b2dc510e0017b4a06c4f6a755869c32a2faabc3b50cc5988655d266ccdbf5ea7999030fdcd145b441675b59a6aef10c9bd5a473d91b9c440000000e09d4108361cff5e396f59396b70418fe2312948e1a3c5d4ee4838ecb9c517a91e548a0070cbf9d67a66ae77398208272af4a4759e939c66560148b261e77f70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE 1996 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1996 1976 iexplore.exe 30 PID 1976 wrote to memory of 1996 1976 iexplore.exe 30 PID 1976 wrote to memory of 1996 1976 iexplore.exe 30 PID 1976 wrote to memory of 1996 1976 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c96896c49cf73b5215b4c24fd7c430fd_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e82a01e733f46777c53ab8f8277ec17
SHA1a2ec0a1f103731bbee06a3e912127007894d4f4d
SHA256481d40b283936d9b3028fca85958c0053a13a33ee9fad1ef16f01f7844cb29b2
SHA5121ca6aea784c5675cd41a66da42d359a3e69c26e36562369ad7079144ec9b90cde85ce6d751b206a15d9cae7ca61847d009b7ca2dd3a94b907e2a1203ae37a8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b517c5924325b0b5052dd777cf30c999
SHA167b38032aec8b289c541b8e9150fb667586a9a07
SHA256e456edec466141fcf20407aafbc5bc77ea4ec4b73f602d9b3b2fd7ef83794282
SHA512a5d3a5efc193fd45ebf891c1d55107b037c40c62e7606f9faa41bc32ced465e3a553d4b848e33ec48161554a5a48f9ca6c9325ea7f5751f91e7c2f08faa1333c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a94e120935da1bfd9c5cb96cd37efb74
SHA185b5996772c234e5f4f9b85b2088e48f7dab7185
SHA256f0ec289f120dcbfb8a61993460874323f9ae19df90431cb6cfeadbbb920b2134
SHA512df7831146102d57e0340bd33decbbb35982e6d9073827ee586b092ef020a71de6dc94179f7a42a535d74294228d0e0660aa1fd541c82eb473023835a88409401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d89b4d7a8b82cb5aef91bf4efcc0ded9
SHA1d256c2054b61ca5268539130f2cc027b77138584
SHA25601a682dd2225f44cc8842309fbe8854e402ea2a55d363968f0b5a51248207da6
SHA512a07cd31f78ec092878e4509f4a4b0d209a852683b41f04238522c0c93de7f3ff47f761c9657fe604d39ef55169bfc6fdbb7084b6b1b2a534fcc02639fa76b0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d61fc0125abc5cb6123bc2d68b4f72b7
SHA15dce0bdb30195c31aaaf23afc5f6a7496a8c1f93
SHA25648652d784271fcd347a1a40c9a06d2f059bdc19f41c624ac1dfc8b0988894620
SHA51240af43a091fa75b4569a94250122685ea4549f3e20fa22095a8d6e6215e6bcbb42d50fa33e40fcb55482fe9b968f704ecbc90515312aaf6c084d9c967d2c613d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcc6308d69504470f62712cee9efec48
SHA13fb91f00ade508feab8604e43562153ed5e20cd5
SHA256f4afda880cb8ff5b49515da472f7425f1548b726527a3bb9cbac6b6b834e313e
SHA5121939ef48d76aa30650fef000f91143ef02631dc88d5ca49616dfd619d4d1613c9c28926eab1f8cc77782ce40906dc76f52df6da06a8ce15b3a4671643af6765e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535705f2cd6727bf0ac6ba51108bbd403
SHA115a8bdaa08de3571bf1caeda22228b3178bd92ca
SHA256b11aad5e2af48ab6b0f224a39041963d656d0d5d46d6d0589a1b5427f8517f59
SHA5127888e20e10a7fccf66c39352dd1f786c11d8050fbc9ede8947aa3dd0e89958cfc09a27cd16069ee366136968eb9a45ac6fb3ad6e99e7e3d09e7ba6ed113c6e14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b755fe1383e4f79bde54ca6e8c8f393
SHA1e368d918f3e63249bce74f31caafdf692be940c4
SHA256b721d00a9431cf54aab0a05332aa859cdd34f020f912886704a8b21372840ced
SHA5126d1e3aa84a5ccfcf87511b07ef40108a8f806bee992a8e09c30268db727de800f82eada08def779c000a343ef718cedeb25f9cc90ac9efe88a271647cc77afb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee8738b117ce3b2ee70efc01fa19c81e
SHA1d5943336e38313d17b3f2459969bfa6d2186c44c
SHA256ebd78f786e3fe7832371bd928c904ca3107f5bd5e2470698a09984e643456cbc
SHA512caf4295905fc93640c6a2a5d9cc3ad824892c551fed52e54887cad13b81bb8fdabec2fc8785f32808bcb885bfadedb9279bdf1db63f17a55fe50d15f084148e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5875ab628f04417fdcc276ccca4bb3212
SHA145c6b8b39207e2ab03d3ae0f54783899ce7bb303
SHA25686bc6cd817e143e445800dc68baa412a8b62d2beaa71c23b5038cfb6a58b8830
SHA5125a4f3703e9ebace548c19f762b04b0cd320896b4ab8671f1159861c404df95bdd27ff16b1000ebdc53683b87db88d5a693b3398ae9a61f3c575a4eee0a907856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57933f0c29aca35da418dece95d9ad47e
SHA1faf4f13afc2e39b44daede417dfcdd7743edf7fd
SHA25636daa72fc5b2299bc0b9798c110b2ad49b569f7cca0aee12817701b4dbde20e6
SHA512e3357d4647c23a9f1bffb84708590e08437ec3a7a35c7ee641c4deec1f5f99c2dbd018fbeee21549129ebcc0b5426f3f3a4c31491c2b57aa8fcb656304be79c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2e7535fa6b54a8a140acae392494efe
SHA15627d6d236ee08f1f68399c83fd57721b8243340
SHA2566e0d222f94e84f43b738a2216185ad2aa770c73975ba5d5114f82bffc02b096b
SHA512c2a608d8f9f76348c7e4021a0bbbd7322158857c6b534a54daaecbf04c43d863dd975ad16e32dffc3b173b23a400141b61c0d4157b06b28b6341426d8ec7da72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8c826c7cf9557320dfaf1ab9c49201d
SHA1daabe9090b853cd55dbfd699636dc7ae01423947
SHA25656eb8face4c09d7f9134e85582590fad841f7a813d0cb6280b2a235029966e79
SHA5128edd6263b58dcbc2bac2491b2e6893116efa88457a963071dae23d24a462b2cf9e04a59dc8ecf1e6243defb77f32537ba3aee8f6d06ff387e16841348f2f9088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab768e2fb333b063648709dbee3414bd
SHA1dd752c9a06d8a60467517e255026c55618b3348a
SHA2569a7889221894c883b351325705dc92984dc1ee8da8407273e3b6644218dd14da
SHA51200de446784e75b3135d915bbc4fa1757225c509283f3656817eceef08883fdf7e83e9a3e8f5bb3ff973b1d187175b67fa76ff0985ebe1add3baa714503dba7f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58dcc94054bebfddbfc73f550dc89448c
SHA10b69ec5594e66001b08dc7423e945edaa786d076
SHA256aaf7322b2edf5ccd3272ff0e5ef1db12d819b6136a353ef1061148b846f4f161
SHA51210757a42b8a71d02214e2eb9f5c6cebd15fbbee5a2189417348a5513881bfb3b19532ae0c2381943a27421c3f6fe8c137c9766063db3371c5ebf1cd1c55ff021
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b66ac5cd155760eb6f4217615cd73a5
SHA1fb8a119b7c532e5472b741f60d4ade276dd82475
SHA25660a08e512da63de4baa9a0f369d1e6b3852ed3017b00a15156acf30b77d913e8
SHA512e0ccc65b2f09c11d5917c33a6ea2f1e863a045dcd5d0cae19789e8cc91fe1cecc28ee1468d01fee8c2645fdb574d43bb8efb0fbda92a43fcbfebe3405ed12655
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b